Ubuntu: 5946-1 High: XStream Remote Code Execution and DoS Threats

ubuntu

March 13, 2023

Several security issues were fixed in XStream.

Summary

Several security issues were fixed in XStream.

Software Description:

- libxstream-java: Java library to serialize objects to XML and back again

Details:

Lai Han discovered that XStream incorrectly handled certain inputs.

If a user or an automated system were tricked into opening a specially

crafted

input file, a remote attacker could possibly use this issue to cause a

denial

of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

(CVE-2021-39140)

It was discovered that XStream incorrectly handled certain inputs. If

a user or an automated system were tricked into opening a specially crafted

input file, a remote attacker could possibly use this issue to execute

arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04

LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,

CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149,

CVE-2021-39151, CVE-2021-39153, CVE-2021-39154)

It was discovered th...

Read the Full Advisory

Topics Covered

security advisory denial of service remote code execution high ubuntu libxstream-java

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   libxstream-java                 1.4.19-1ubuntu0.1

Ubuntu 22.04 LTS:
   libxstream-java                 1.4.18-2ubuntu0.1

Ubuntu 20.04 LTS:
   libxstream-java                 1.4.11.1-1ubuntu0.3

Ubuntu 18.04 LTS:
   libxstream-java                 1.4.11.1-1+deb10u4build0.18.04.1

Ubuntu 16.04 ESM:
   libxstream-java                 1.4.8-1ubuntu0.1+esm1

Ubuntu 14.04 ESM:
   libxstream-java                 1.4.7-1ubuntu0.1+esm1

In general, a standard system update will make all the necessary changes.