Skip to content
OpenAdvisories
Medium DLA-2507-1 2 CVEs

libxstream-java - security update

Published Dec 31, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 libxstream-java 1.4.11.1-1+deb9u1

Vulnerabilities 2

  • Medium 6.8
    CVE-2020-26259 Public exploit EPSS 82%

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know fi…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 6.3
    CVE-2020-26258 Public exploit Scanner template EPSS 82%

    Server-Side Forgery Request can be activated unmarshalling with XStream

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from interna…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven