Summary
[1.3.1-13]
- Fix remote code execution vulnerability
- Resolves: CVE-2021-21344
- Resolves: CVE-2021-21345
- Resolves: CVE-2021-21346
- Resolves: CVE-2021-21347
- Resolves: CVE-2021-21350
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | xstream | 0:1.3.1-13.el7_9 |
| Oracle Linux · 7 | xstream-javadoc | 0:1.3.1-13.el7_9 |
Vulnerabilities 5
-
Medium 6.1CVE-2021-21346 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 6.1CVE-2021-21347 EPSS 14%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 5.8
XStream is vulnerable to a Remote Command Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…
-
Medium 5.3CVE-2021-21344 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 5.3CVE-2021-21350 EPSS 15%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, …