XStream is vulnerable to remote code execution. The vulnerability exists due to the regression of security vulnerability CVE-2013-7285, allowing a remote attacker to trigger RCE during unmarshaling XML or any supported format.

CPENameOperatorVersion
xstream coreeq1.4.10
xstream coreeq1.4.10

CPE	Name	Operator	Version
	xstream core	eq	1.4.10
	xstream core	eq	1.4.10

References

x-stream.github.io/changes.html#1.4.11

access.redhat.com/errata/RHSA-2019:3892

access.redhat.com/errata/RHSA-2019:4352

access.redhat.com/errata/RHSA-2020:0445

access.redhat.com/errata/RHSA-2020:0727

bugzilla.redhat.com/show_bug.cgi?id=1722971

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173

github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d3

www.oracle.com//security-alerts/cpujul2021.html

www.oracle.com/security-alerts/cpuapr2020.html

www.oracle.com/security-alerts/cpuApr2021.html

www.oracle.com/security-alerts/cpujan2021.html

www.oracle.com/security-alerts/cpuoct2020.html

www.sourceclear.com/vulnerability-database/vulnerabilities/1619

myhack58 1

osv 6

ibm 9

github 5

redhatcve 3

debiancve 2

prion 2

nvd 2

cve 2

ubuntucve 2

cvelist 2

redhat 18

nessus 10

packetstorm 1

fedora 2

openvas 8

checkpoint_advisories 1

gentoo 1

mageia 1

nuclei 1

zdt 1

exploitpack 1

symantec 1

exploitdb 1

freebsd 1

oracle 5

myhack58

Xstream remote code execution vulnerability-vulnerability warning-the black bar safety net

2019-07-25 00:00:00

osv

Deserialization of Untrusted Data and Code Injection in xstream

2019-07-26 16:09:47

CVE-2019-10173

2019-07-23 13:15:13

Command Injection in Xstream

2019-05-29 18:05:03

ibm

Security Bulletin: XStream as used by IBM QRadar SIEM is vulnerable to OS command injection (CVE-2019-10173)

2019-11-20 17:14:22

Security Bulletin: Multiple vulnerabilities in Xstream affect IBM InfoSphere Information Server

2019-11-01 20:48:15

Security Bulletin: CVE-2019-10173CVE-2019-10173 xstream API If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands

2020-11-18 20:31:41

github

Deserialization of Untrusted Data and Code Injection in xstream

2019-07-26 16:09:47

Command Injection in Xstream

2019-05-29 18:05:03

Server-Side Forgery Request can be activated unmarshalling with XStream

2020-12-21 16:28:42

redhatcve

CVE-2019-10173

2019-07-22 14:36:13

CVE-2020-26259

2020-12-17 20:48:46

CVE-2020-26258

2020-12-17 20:48:37

debiancve

CVE-2019-10173

2019-07-23 13:15:13

CVE-2013-7285

2019-05-15 17:29:00

prion

Deserialization of untrusted data

2019-07-23 13:15:00

Design/Logic Flaw

2019-05-15 17:29:00

nvd

CVE-2019-10173

2019-07-23 13:15:13

CVE-2013-7285

2019-05-15 17:29:00

cve

CVE-2019-10173

2019-07-23 13:15:13

CVE-2013-7285

2019-05-15 17:29:00

ubuntucve

CVE-2019-10173

2019-07-23 00:00:00

CVE-2013-7285

2019-05-15 00:00:00

cvelist

CVE-2019-10173

2019-07-23 12:50:44

CVE-2013-7285

2019-05-15 16:54:57

redhat

(RHSA-2014:0294) Important: XStream security update

2014-03-13 19:11:29

(RHSA-2014:0216) Important: XStream security update

2014-02-26 20:31:01

(RHSA-2014:0389) Important: jasperreports-server-pro security update

2014-04-09 00:00:00

nessus

Fedora 19 : xstream-1.3.1-5.1.fc19 (2014-2340)

2014-02-23 00:00:00

Fedora 20 : xstream-1.3.1-9.fc20 (2014-2372)

2014-02-23 00:00:00

GLSA-201612-35 : XStream: Remote execution of arbitrary code

2016-12-13 00:00:00

packetstorm

OpenMRS Reporting Module 0.9.7 Remote Code Execution

2016-01-06 00:00:00

fedora

[SECURITY] Fedora 20 Update: xstream-1.3.1-9.fc20

2014-02-22 00:47:06

[SECURITY] Fedora 19 Update: xstream-1.3.1-5.1.fc19

2014-02-22 00:56:20

openvas

Mageia: Security Advisory (MGASA-2014-0100)

2022-01-28 00:00:00

Fedora Update for xstream FEDORA-2014-2372

2014-02-25 00:00:00

Fedora Update for xstream FEDORA-2014-2340

2014-02-25 00:00:00

checkpoint_advisories

XStream Library Insecure Deserialization (CVE-2019-10173)

2020-02-26 00:00:00

gentoo

XStream: Remote execution of arbitrary code

2016-12-13 00:00:00

mageia

Updated xstream packages fix CVE-2013-7285

2014-02-26 01:54:53

nuclei

XStream <1.4.6/1.4.10 - Remote Code Execution

2023-03-12 03:38:05

zdt

OpenMRS Reporting Module 0.9.7 - Remote Code Execution

2016-01-07 00:00:00

exploitpack

OpenMRS Reporting Module 0.9.7 - Remote Code Execution

2016-01-07 00:00:00

symantec

XStream API CVE-2019-10173 Deserialization Remote Code Execution Vulnerability

2019-07-23 00:00:00

exploitdb

OpenMRS Reporting Module 0.9.7 - Remote Code Execution

2016-01-07 00:00:00

freebsd

jenkins -- multiple vulnerabilities

2014-02-14 00:00:00

oracle

Oracle Critical Patch Update Advisory - October 2020

2020-10-20 00:00:00

Oracle Critical Patch Update Advisory - January 2021

2021-01-19 00:00:00

Oracle Critical Patch Update Advisory - July 2021

2021-07-20 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

0.942 High

EPSS

Percentile

99.2%

JSON

Related for VERACODE:20878