{"id":"CVE-2019-4732","aliases":["EUVD-2019-14339","GHSA-764v-x3h3-f6pj","SUSE-SU-2020:0466-1","SUSE-SU-2020:0528-1"],"status":"published","title":"IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and...","description":"IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.","severity":{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AC:H/AV:L/PR:H/I:H/C:H/A:H/S:C/UI:R/E:U/RC:C/RL:O","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0054,"percentile":0.45726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-426"],"published":"2020-02-03T16:45:18Z","modified":"2026-06-17T02:36:51Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-3.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-3.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-3.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-3.33.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr6.5-30.63.1"}]}],"bundled":5}],"products":[{"vendor":"ibm","product":"java"},{"vendor":"ibm","product":"sdk"},{"vendor":"ibm","product":"websphere_application_server"},{"vendor":"oracle corporation","product":"java"}],"references":[{"url":"https://www.ibm.com/support/pages/node/1288060","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/172618","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-4732"},{"url":"https://github.com/advisories/GHSA-764v-x3h3-f6pj"},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200466-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160968","tags":["report"]},{"url":"https://bugzilla.suse.com/1162972","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-4732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-2659","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200528-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-4732","description":"IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.","status":"published","published":"2020-02-03T16:45:18.286Z","modified":"2024-09-16T22:09:29.963Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AC:H/AV:L/PR:H/I:H/C:H/A:H/S:C/UI:R/E:U/RC:C/RL:O","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:20:24.989116Z"}],"euvd":[{"id":"EUVD-2019-14339","description":"IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.","status":"published","published":"2020-02-03T16:45:18Z","modified":"2024-09-16T22:09:29Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AC:H/AV:L/PR:H/I:H/C:H/A:H/S:C/UI:R/E:U/RC:C/RL:O","level":"high"}],"updated_at":"2026-11-03T00:55:05.279117Z"}],"ghsa":[{"id":"GHSA-764v-x3h3-f6pj","title":"IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and...","description":"IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.","status":"published","published":"2022-05-24T17:07:52Z","modified":"2023-01-29T05:01:25Z","updated_at":"2026-11-02T14:44:48.898243Z"}],"nvd":[{"id":"CVE-2019-4732","description":"IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.","status":"published","published":"2020-02-03T17:15:14.627Z","modified":"2026-06-17T02:36:51.667Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"SUSE-SU-2020:0466-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nJava 8.0 was updated to Service Refresh 6 Fix Pack 5 (bsc#1162972, bsc#1160968)\n\n- CVE-2020-2583: Unlink Set of LinkedHashSets\n- CVE-2019-4732: Untrusted DLL search path vulnerability \n- CVE-2020-2593: Normalize normalization for all\n- CVE-2020-2604: Better serial filter handling\n- CVE-2020-2659: Enhance datagram socket support\n","status":"published","published":"2020-02-25T10:59:38Z","modified":"2025-05-02T04:09:19.109526Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0528-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nJava 8.0 was updated to Service Refresh 6 Fix Pack 5 (bsc#1162972, bsc#1160968)\n\n- CVE-2020-2583: Unlink Set of LinkedHashSets\n- CVE-2019-4732: Untrusted DLL search path vulnerability \n- CVE-2020-2593: Normalize normalization for all\n- CVE-2020-2604: Better serial filter handling\n- CVE-2020-2659: Enhance datagram socket support\t  \n","status":"published","published":"2020-03-18T18:12:32Z","modified":"2026-02-04T02:33:12.938692Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}