USN-6978-1: XStream vulnerabilities
22 August 2024
Several security issues were fixed in XStream.
Releases
Packages
- libxstream-java - Java library to serialize objects to XML and back again
Details
It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host. A remote attacker could use this to delete arbitrary
known files on the host as long as the executing process had sufficient
rights only by manipulating the processed input stream. (CVE-2020-26259)
It was discovered that XStream was vulnerable to denial of service,
arbitrary code execution, arbitrary file deletion and server-side forgery
attacks. A remote attacker could cause any of those issues by
manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342,
CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346,
CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350,
CVE-2021-21351)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
libxstream-java
-
1.4.8-1ubuntu0.1+esm3
Available with Ubuntu Pro
Ubuntu 14.04
-
libxstream-java
-
1.4.7-1ubuntu0.1+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
Related notices
- USN-4943-1: libxstream-java
- USN-4714-1: libxstream-java