CVE-2024-47072

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the...

CVE-2024-47072 XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the...

CVE-2024-47072

CVE-2024-47072 affects the XStream library. When configured to use the BinaryStreamDriver, processing manipulated binary input can trigger a stack overflow, leading to a Denial of Service. XStream 1.4.21 mitigates this by detecting the input manipulation and throwing an InputManipulationException...

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. Patches XStream 1.4.21 detects the manipulation ...

ai.hyacinth.framework:core-service-admin-server (>=0.5.0 <=0.5.24), ai.hyacinth.framework:core-service-discovery-server (>=0.5.0 <=0.5.24) +8570 more potentially affected by CVE-2024-47072 via com.thoughtworks.xstream:xstream (>=1.1.1 <=1.4.20)

com.thoughtworks.xstream:xstream MAVEN version =1.1.1, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =cloud-0.1, =0.0.1, =0.0.10, =0.0.10, =0.0.10, =0.2.2, =0.0.11, =0.8.38, =0.8.38, =0.8.38, =0.8.42 and more Source cves: CVE-2024-47072 Source advisory: OSV:GHSA-HFQ9-HGGM-C56Q...

PT-2024-7918

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.21 Bitbucket Data Center and Server versions 8.6.0 through 8.19.0 Bitbucket Data Center and Server versions 9.0.0 through 9.4.0 Bitbucket Data Center and Server version 8.9.0 through 8.9.23 Bitbucket Data Center a...

RHSA-2021:3956 Red Hat Security Advisory: xstream security update

Bulletin has no description...

RHSA-2021:2683 Red Hat Security Advisory: xstream security update

Bulletin has no description...

RHSA-2021:1354 Red Hat Security Advisory: xstream security update

Bulletin has no description...

RHSA-2021:0162 Red Hat Security Advisory: xstream security update

Bulletin has no description...

Ubuntu: Security Advisory (USN-6978-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6978-1: XStream vulnerabilities

It was discovered that XStream incorrectly handled parsing of certain crafted XML documents. A remote attacker could possibly use this issue to read arbitrary files. CVE-2016-3674 Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run...

Ubuntu 14.04 LTS / 16.04 LTS : XStream vulnerabilities (USN-6978-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6978-1 advisory. It was discovered that XStream incorrectly handled parsing of certain crafted XML documents. A remote attacker could possibly use this issue ...

Atlassian Jira Service Management Data Center and Server < 5.4.18 / 5.5.x < 5.8.0 / 5.12.0 (JSDSERVER-15436)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15436 advisory. - XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote...

OPENSUSE-SU-2024:11809-1 xstream-1.4.19-1.1 on GA media

These are all security issues fixed in the xstream-1.4.19-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12796-1 xstream-1.4.20-1.1 on GA media

These are all security issues fixed in the xstream-1.4.20-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10592-1 xstream-1.4.18-1.1 on GA media

These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed...

Poc

This repository contains a collection of proof-of-concept PoC exploits and tools for various vulnerabilities. The primary focus is on Java-based exploits, with some Python scripts also present. The Java exploits target vulnerabilities in Java applications, including a deserialization vulnerabilit...

NextGen Healthcare Mirth Connect Under Attack - CISA Issues Urgent Warning

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a security flaw impacting NextGen Healthcare Mirth Connect to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2023-43208 CVSS score: N/A, concerns a cas...

RHEL 7 : xstream (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulati...