Description
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxstream-java | 1.4.9-2 | — |
| Debian 13 | libxstream-java | 1.4.9-2 | — |
| Debian 12 | libxstream-java | 1.4.9-2 | — |
| Debian 8 | libxstream-java | 1.4.7-2+deb8u2 | DSA-3841-1 |
| Debian 7 | libxstream-java | 1.4.2-1+deb7u2 | DLA-930-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | libxstream-java | 1.4.8-1ubuntu0.1 | — |
| Ubuntu 14.04 LTS | libxstream-java | 1.4.7-1ubuntu0.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server 3.2 | apache-commons-lang3 | 3.4-3.3.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | cobbler | 2.6.6-6.16.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | drools +2 | 7.17.0-3.3.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | guava | 27.0.1-3.3.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | jade4j | 1.0.7-3.3.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | kie-soup | 7.17.0.Final-2.3.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | py26-compat-salt | 2016.11.10-6.21.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | reprepro | 5.3.0-2.3.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | smdba | 1.6.4-0.3.9.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | spacecmd | 2.8.25.10-3.20.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | spacewalk-admin | 2.8.4.4-3.6.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | spacewalk-backend | 2.8.57.14-3.25.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | spacewalk-branding | 2.8.5.15-3.19.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | spacewalk-certs-tools | 2.8.8.7-3.6.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | spacewalk-java | 2.8.78.21-3.29.1 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | spacewalk-web | 2.8.7.15-3.24.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | subscription-matcher | 0.23-4.12.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | susemanager | 3.2.17-3.22.4 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | susemanager-schema | 3.2.18-3.22.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | susemanager-sls | 3.2.23-3.26.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | susemanager-sync-data | 3.2.14-3.20.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.2 | xstream | 1.4.10-4.3.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Server 3.1 | xstream | 1.4.9-3.3.1 | SUSE-SU-2017:3390-1 |
| SUSE Manager Server 3.0 | xstream | 1.4.9-4.3.1 | SUSE-SU-2017:3389-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Proxy 3.2 | spacewalk-backend | 2.8.57.14-3.25.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Proxy 3.2 | spacewalk-certs-tools | 2.8.8.7-3.6.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
| SUSE Manager Proxy 3.2 | spacewalk-web | 2.8.7.15-3.24.3 | SUSE-SU-2019:1006-1, SUSE-RU-2019:1006-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xstream | 1.4.18-1.1 | openSUSE-SU-2024:10592-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | < 1.4.10 | 1.4.10 | GHSA-7hwc-46rm-65jh |
Advisories 10
- DLA-930-1 libxstream-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3841-1 libxstream-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-RU-2019:1006-1 Security update for SUSE Manager Server 3.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1006-1 Security update for SUSE Manager Server 3.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:3389-1 Security update for xstream SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10592-1 xstream-1.4.18-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:3390-1 Security update for xstream SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2024-0094 Atlassian Bamboo: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 15, 2024
References
- RHSA-2017:2888 vendor-advisory
- RHSA-2017:1832 vendor-advisory
- RHSA-2017:2889 vendor-advisory
- 1039499 vdb-entry
- https://www-prd-trops.events.ibm.com/node/715749
- xstream-cve20177957-dos(125800) vdb-entry
- DSA-3841 vendor-advisory
- http://x-stream.github.io/CVE-2017-7957.html
- 100687 vdb-entry