MGASA-2017-0119

    Dashboard / Vulnerabilities / MGASA-2017-0119

    MGASA-2017-0119

    Published: 30 Apr 2017Last Modified: 16 Apr 2026

    Summary: Updated xstream packages fix security vulnerability

    Details: A vulnerability was found in XStream. Parsing a maliciously crafted file could cause the application to crash. The processed stream at unmarshalling type contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. The crash occurrs if this information advices XStream to create an instance of the primitive type 'void'. This situation can only happen if an attacker was able to manipulate the incoming data, since such an instance does not exist (rhbz#1441538).

    References: https://advisories.mageia.org/MGASA-2017-0119.html, https://bugs.mageia.org/show_bug.cgi?id=20704, https://lists.fedoraproject.org/archives/list/[email protected]/thread/NINYW4L2T4MRN4RGENSWNBLOTKM7WD3T/

    Affected packages

    Package

    Name: xstream

    Purl: pkg:rpm/mageia/xstream?arch=source&distro=mageia-5

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.4.9-1.1.mga5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High