UbuntuUpdates.org

Package "libxstream-java"

Name: libxstream-java

Description:

Java library to serialize objects to XML and back again
Latest version: 1.4.11.1-1+deb10u4build0.18.04.1
Release: bionic (18.04)
Level: security
Repository: universe
Homepage: http://x-stream.github.io

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libxstream-java"

All arch deb package
APT INSTALL

Other versions of "libxstream-java" in Bionic

Repository Area Version
base universe 1.4.10-1
updates universe 1.4.11.1-1+deb10u4build0.18.04.1

Changelog

Version: 1.4.11.1-1+deb10u4build0.18.04.1 2023-03-13 13:06:51 UTC

  libxstream-java (1.4.11.1-1+deb10u4build0.18.04.1) bionic-security; urgency=medium

  * fake sync from Debian

 -- Amir Naseredini <email address hidden> Mon, 06 Mar 2023 16:05:36 +0000
Source diff to previous version

Version: 1.4.11.1-1~18.04.2 2021-05-11 11:08:51 UTC

  libxstream-java (1.4.11.1-1~18.04.2) bionic-security; urgency=medium

  * Merge from Debian.
  * SECURITY UPDATE: Arbitrary code execution.
    - debian/patches/CVE-2021-21341-to-CVE-2021-21351.patch: The type
    hierarchies for java.io.InputStream, java.nio.channels.Channel,
    javax.activation.DataSource and javax.sql.rowsel.BaseRowSet are now
    blacklisted as well as the individual types
    com.sun.corba.se.impl.activation.ServerTableEntry,
    com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator,
    sun.awt.datatransfer.DataTransferer$IndexOrderComparator, and
    sun.swing.SwingLazyValue. Additionally the internal type
    Accessor$GetterSetterReflection of JAXB, the internal types
    MethodGetter$PrivilegedGetter and ServiceFinder$ServiceNameIterator of
    JAX-WS, all inner classes of javafx.collections.ObservableList and an
    internal ClassLoader used in a private BCEL copy are now part of the
    default blacklist and the deserialization of XML containing one of the two
    types will fail. You will have to enable these types by explicit
    configuration, if you need them.
    - CVE-2021-21341
    - CVE-2021-21342
    - CVE-2021-21343
    - CVE-2021-21344
    - CVE-2021-21345
    - CVE-2021-21346
    - CVE-2021-21347
    - CVE-2021-21348
    - CVE-2021-21349
    - CVE-2021-21350
    - CVE-2021-21351

 -- Eduardo Barretto <email address hidden> Wed, 28 Apr 2021 17:06:48 +0200
Source diff to previous version
CVE-2021-21341 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remo
CVE-2021-21351 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote a
CVE-2021-21342 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed
CVE-2021-21343 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed
CVE-2021-21344 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re
CVE-2021-21345 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re
CVE-2021-21346 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re
CVE-2021-21347 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re
CVE-2021-21348 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re
CVE-2021-21349 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re
CVE-2021-21350 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a re

Version: 1.4.11.1-1~18.04.1 2021-01-28 21:06:18 UTC

  libxstream-java (1.4.11.1-1~18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Command Injection Vulnerability
    - debian/patches/CVE-2020-26217.patch: New predefined blacklist avoids
      vulnerability due to improper setup and update security vulnerability
      test to test default.
    - debian/patches/CVE-2020-26259.patch: Fix arbitrary File Deletion on the
      local host.
    - CVE-2020-26217
    - CVE-2020-26259
  * SECURITY UPDATE: Server-Side Request Forgery Vulnerability
    - debian/patches/CVE-2020-26258.patch: Fix access data streams from an
      arbitrary URL.
    - CVE-2020-26258
  * Add a new maven rule to fix FTBFS.
    - debian/maven.ignoreRules: Add com.sun.xml.ws jaxws-rt.

 -- Paulo Flabiano Smorigo <email address hidden> Thu, 28 Jan 2021 14:36:59 +0000
Source diff to previous version
CVE-2020-26217 XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands on
CVE-2020-26259 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion o
CVE-2020-26258 XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability c

Version: 1.4.11.1-1~18.04 2019-04-16 17:07:56 UTC

  libxstream-java (1.4.11.1-1~18.04) bionic; urgency=medium

  * Backport for OpenJDK 11. LP: #1814133.


About   -   Send Feedback to @ubuntu_updates