USN-4943-1: XStream vulnerabilities

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. This issue affected only affected Ubuntu 20.10. CVE-2020-26217 It was discovered that XStream was vulnerable to...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream

Summary Multiple vulnerabilities in XStream that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID: CVE-2020-26217 DESCRIPTION: XStream could allow a remote attacker to execute arbitrary code on the system, caused by flaws in the XStream.java and...

CentOS 7 : xstream (RHSA-2021:1354)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1354 advisory. - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a...

xstream security update

CentOS Errata and Security Advisory CESA-2021:1354 An update for xstream is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Security Bulletin: XStream XML information discloure vulnerability affects IBM® Rational® Quality Manager (CVE-2016-3674)

Summary XStream XML information discloure in XStream libraries shipped with IBM Rational Quality Manager could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2016-3674 DESCRIPTION: XStream libraries shipped with IBM Rational Quality Manager could allow a...

XStream Library Arbitrary File Deletion (CVE-2020-26259)

An arbitrary file deletion vulnerability exists in the XStream library. The vulnerability is due to improper validation of user input during unmarshalling of XML and JSON data...

Oracle Linux 7 : xstream (ELSA-2021-1354)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1354 advisory. - Resolves: CVE-2021-21344 - Resolves: CVE-2021-21345 - Resolves: CVE-2021-21346 - Resolves: CVE-2021-21347 Tenable has extracted the preceding...

xstream security update

1.3.1-13 - Fix remote code execution vulnerability - Resolves: CVE-2021-21344 - Resolves: CVE-2021-21345 - Resolves: CVE-2021-21346 - Resolves: CVE-2021-21347 - Resolves: CVE-2021-21350...

XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue

A flaw was found in xstream. A remote attacker can load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry

A flaw was found in xstream. A remote attacker, who has sufficient rights, can execute commands of the host by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader

A flaw was found in xstream. A remote attacker may be able to execute arbitrary code only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet

A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Important: Red Hat Security Advisory: xstream security update

An update for xstream is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 7 : xstream (RHSA-2021:1354)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1354 advisory. XStream is a Java XML serialization library to serialize objects to and deserialize object from XML. Security Fixes: XStream: Unsafe...

openSUSE: Security Advisory for xstream (openSUSE-SU-2021:0140-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating

Summary XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. Vulnerability Details Refer t...

[SECURITY] [DLA 2616-1] libxstream-java security update

Debian LTS Advisory DLA-2616-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany April 03, 2021 https://wiki.debian.org/LTS Package : libxstream-java Version : 1.4.11.1-1+deb9u2 CVE ID : CVE-2021-21341 CVE-2021-21342 CVE-2021-21343 CVE-2021-21344 CVE-2021-21345...

Vulnerabilities fixed in XStream

Vulnerabilities have been fixed in XStream. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution User rights Access to sensitive data The...

CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...