CVE-2019-4473 Code injection in Java
Local attackers can exploit insecure RPATHs in IBM Java SDK binaries on AIX to execute arbitrary code and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-4473?
CVE-2019-4473 is a high-severity code injection vulnerability in IBM Java, published on 5 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.
Weakness: CWE-427
Which versions are affected by CVE-2019-4473?
It affects 1 product.
Products include Ibm Java.
How do I fix CVE-2019-4473?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-4473 being exploited?
There is no known exploitation of CVE-2019-4473 in the wild and no public exploit code.
Other vulnerabilities in IBM Java
Sources
Also known as GHSA-qh47-rvff-ggv7.