Duplicate Advisory: Denial of Service due to parser crash

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8cc-g7j8-xxpm. This link is maintained to preserve external references. Original Description Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running...

CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40156

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2022-40154

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...

UBUNTU-CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40155

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2022-40153

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage...

Input validation

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40151

CVE-2022-40151 affects XStream: a Denial of Service via stack-based overflow when parsing XML data. IBM bulletin for SPSS Collaboration and Deployment Services notes this CVE among multiple Woodstox/XStream issues and provides remediation via IFix download for SPSS versions 8.5 and 8.6 (IM-SCaDS-...

CVE-2022-40151

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40151 Stack Buffer Overflow in xstream

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40151 Stack Buffer Overflow in xstream

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2022-40151 Stack Buffer Overflow in xstream

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

XStream 缓冲区错误漏洞

XStream is a lightweight, easy-to-use, open source Java class library from the XStream team that is primarily used to serialize or deserialize objects into XML JSON. XStream suffers from a buffer error vulnerability that stems from the fact that when a user uses it to serialize XML data, if the...

PT-2022-25248 · Xstream · Xstream

Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified Description: The issue allows for Denial of Service attacks when the parser is running on user-supplied input. An attacker may supply content that causes the parser to crash by stackoverflow, supporting...

XStream 缓冲区错误漏洞

XStream is a lightweight, easy-to-use open source Java class library from the XStream team that is primarily used to serialize objects into XML JSON or deserialize them. XStream suffers from a buffer error vulnerability that stems from the fact that when a user uses it to serialize XML data, if t...

PT-2022-25250 · Fasterxml · Fasterxml/Woodstox

Name of the Vulnerable Software and Affected Versions: Xstream affected versions not specified FasterXML/woodstox affected versions not specified Description: The issue allows an attacker to cause a denial of service attack by supplying content that causes the parser to crash due to a stack...

Atlassian Jira < 8.13.19 / 8.14.x < 8.20.7 / 8.21.x < 8.22.1 RCE (JRASERVER-73582)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is affected by remote code execution vulnerability. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute...

security/keycloak -- Multiple possible DoS attacks

CIRCL reports: CVE-2022-41966: XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. CVE-2022-40151: I...