Description
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- Debian / debian_linux8.0 – 8.0
- Debian / debian_linux9.0 – 9.0
- RedHat / fuse1.0 – 1.0
- RedHat / jboss_middleware1 – 1
- xstream / xstream1.4.9
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2017:2888
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2017:1832
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2017:2889
- MISChttp://www.securitytracker.com/id/1039499
- MISChttps://www-prd-trops.events.ibm.com/node/715749
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/125800
- VENDOR_ADVISORYhttp://www.debian.org/security/2017/dsa-3841
- MISChttp://x-stream.github.io/CVE-2017-7957.html
- MISChttp://www.securityfocus.com/bid/100687
Updated 10m ago · 8 sources