Skip to content
OpenAdvisories
High USN-6978-1 15 CVEs

libxstream-java vulnerabilities

Published Aug 22, 2024 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that XStream incorrectly handled parsing of certain
crafted XML documents. A remote attacker could possibly use this issue to
read arbitrary files. (CVE-2016-3674)

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery
attacks. A remote attacker could request data from internal resources
that are not publicly available only by manipulating the processed input
stream. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion
on the local host. A remote attacker could use this to delete arbitrary
known files on the host as long as the executing process had sufficient
rights only by manipulating the processed input stream. (CVE-2020-26259)

It was discovered that XStream was vulnerable to denial of service,
arbitrary code execution, arbitrary file deletion and server-side forgery
attacks. A remote attacker could cause any of those issues by
manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342,
CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346,
CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350,
CVE-2021-21351)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS libxstream-java 1.4.7-1ubuntu0.1+esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libxstream-java 1.4.8-1ubuntu0.1+esm3

Vulnerabilities 15

  • High 8.0
    CVE-2020-26217 Public exploit Scanner template EPSS 85%

    Remote Code Execution in XStream

    XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XS…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • High 7.5
    CVE-2016-3674

    XML External Entity Injection in XStream

    Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary fil…

    com.thoughtworks.xstream:xstream libxstream-java libxstream-java Debian Ubuntu Maven
  • High 7.5
    CVE-2021-21341 Public exploit EPSS 78%

    XStream can cause a Denial of Service

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 6.8
    CVE-2020-26259 Public exploit EPSS 82%

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know fi…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 6.3
    CVE-2020-26258 Public exploit Scanner template EPSS 82%

    Server-Side Forgery Request can be activated unmarshalling with XStream

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from interna…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 6.1
    CVE-2021-21346 EPSS 76%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 6.1
    CVE-2021-21347 EPSS 14%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 6.1
    CVE-2021-21349 Public exploit EPSS 47%

    A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 5.8
    CVE-2021-21345 Public exploit Scanner template EPSS 72%

    XStream is vulnerable to a Remote Command Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.4
    CVE-2021-21351 Scanner template EPSS 82%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21342 EPSS 50%

    A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21343 EPSS 47%

    XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creat…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21344 EPSS 76%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…

    x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21348 EPSS 14%

    XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, wh…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-21350 EPSS 15%

    XStream is vulnerable to an Arbitrary Code Execution attack

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, …

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2016-3674
  • report
    https://ubuntu.com/security/CVE-2020-26217
  • report
    https://ubuntu.com/security/CVE-2020-26258
  • report
    https://ubuntu.com/security/CVE-2020-26259
  • report
    https://ubuntu.com/security/CVE-2021-21341
  • report
    https://ubuntu.com/security/CVE-2021-21342
  • report
    https://ubuntu.com/security/CVE-2021-21343
  • report
    https://ubuntu.com/security/CVE-2021-21344
  • report
    https://ubuntu.com/security/CVE-2021-21345
  • report
    https://ubuntu.com/security/CVE-2021-21346
  • report
    https://ubuntu.com/security/CVE-2021-21347
  • report
    https://ubuntu.com/security/CVE-2021-21348
  • report
    https://ubuntu.com/security/CVE-2021-21349
  • report
    https://ubuntu.com/security/CVE-2021-21350
  • report
    https://ubuntu.com/security/CVE-2021-21351