🛡️ USN-6978-1 — libxstream-java (CVE-2016-3674 +14 more)

libxstream-java vulnerabilities

It was discovered that XStream incorrectly handled parsing of certain

crafted XML documents. A remote attacker could possibly use this issue to

read arbitrary files. (CVE-2016-3674)

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code

execution. A remote attacker could run arbitrary shell commands by

manipulating the processed input stream. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery

attacks. A remote attacker could request data from internal resources

that are not publicly available only by manipulating the processed input

stream. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion

on the local host. A remote attacker could use this to delete arbitrary

known files on the host as long as the executing process had sufficient

rights only by manipulating the processed input stream. (CVE-2020-26259)

It was discovered that XStream was vulnerable to denial of service,

arbitrary code execution, arbitrary file deletion and server-side forgery

attacks. A remote attacker could cause any of those issues by

manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342,

CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346,

CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350,

CVE-2021-21351)