MGASA-2014-0100

    Dashboard / Vulnerabilities / MGASA-2014-0100

    MGASA-2014-0100

    Published: 25 Feb 2014Last Modified: 16 Apr 2026
    Upstream:
    CVE-2013-7285

    Summary: Updated xstream packages fix CVE-2013-7285

    Details: Updated xstream packages fix security vulnerability: It was found that XStream would deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application (CVE-2013-7285).

    References: https://advisories.mageia.org/MGASA-2014-0100.html, http://xstream.codehaus.org/security.html, https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128807.html, https://bugs.mageia.org/show_bug.cgi?id=12874

    Affected packages

    Package

    Name: xstream

    Purl: pkg:rpm/mageia/xstream?arch=source&distro=mageia-3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.3.1-6.1.mga3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High