Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
IBM Java 7 on Red Hat may let attackers cause crashes
published 2 years ago
Summary
Red Hat’s IBM‑based Java 7 packages can be tricked into executing malformed data, which could let an attacker disrupt or stop applications that use this Java runtime. This affects all IBM Java 7 packages for Red Hat, including the core, demo, development, JDBC, and plugin versions. Update to the latest Red Hat‑provided Java 7 packages as soon as possible to protect your systems.
What to do
- Update redhat java-1.7.1-ibm to version 1:1.7.1.4.40-1jpp.1.el7.
- Update redhat java-1.7.1-ibm-demo to version 1:1.7.1.4.40-1jpp.1.el7.
- Update redhat java-1.7.1-ibm-devel to version 1:1.7.1.4.40-1jpp.1.el7.
- Update redhat java-1.7.1-ibm-jdbc to version 1:1.7.1.4.40-1jpp.1.el7.
- Update redhat java-1.7.1-ibm-plugin to version 1:1.7.1.4.40-1jpp.1.el7.
- Update redhat java-1.7.1-ibm-src to version 1:1.7.1.4.40-1jpp.1.el7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_extras:7 | redhat | java-1.7.1-ibm |
< 1:1.7.1.4.40-1jpp.1.el7 Fix: upgrade to 1:1.7.1.4.40-1jpp.1.el7
|
| Red Hat:rhel_extras:7 | redhat | java-1.7.1-ibm-demo |
< 1:1.7.1.4.40-1jpp.1.el7 Fix: upgrade to 1:1.7.1.4.40-1jpp.1.el7
|
| Red Hat:rhel_extras:7 | redhat | java-1.7.1-ibm-devel |
< 1:1.7.1.4.40-1jpp.1.el7 Fix: upgrade to 1:1.7.1.4.40-1jpp.1.el7
|
| Red Hat:rhel_extras:7 | redhat | java-1.7.1-ibm-jdbc |
< 1:1.7.1.4.40-1jpp.1.el7 Fix: upgrade to 1:1.7.1.4.40-1jpp.1.el7
|
| Red Hat:rhel_extras:7 | redhat | java-1.7.1-ibm-plugin |
< 1:1.7.1.4.40-1jpp.1.el7 Fix: upgrade to 1:1.7.1.4.40-1jpp.1.el7
|
| Red Hat:rhel_extras:7 | redhat | java-1.7.1-ibm-src |
< 1:1.7.1.4.40-1jpp.1.el7 Fix: upgrade to 1:1.7.1.4.40-1jpp.1.el7
|
Original advisory text
Red Hat Security Advisory: java-1.7.1-ibm security update
References
- https://access.redhat.com/errata/RHSA-2019:0473 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#critical Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1579973 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1665945 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1685611 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0473.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2018-11212 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-11212 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-11212 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2018-12547 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-12547 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-12547 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2019-2422 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-2422 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-2422 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published13 Sep 2024
Updated16 Oct 2026
First seen16 Oct 2026
Sources
RHSA-2019:0473 · OSV
Track software like this
Free during beta