MGASA-2017-0119
Updated xstream packages fix security vulnerability
A vulnerability was found in XStream. Parsing a maliciously crafted file could cause the application to crash. The processed stream at unmarshalling type contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. The crash occurrs if this information advices XStream to create an instance of the primitive type 'void'. This situation can only happen if an attacker was able to manipulate the incoming data, since such an instance does not exist (rhbz#1441538).
What each source reports
OSV No score
Updated xstream packages fix security vulnerability
A vulnerability was found in XStream. Parsing a maliciously crafted file could cause the application to crash. The processed stream at unmarshalling type contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. The crash occurrs if this information advices XStream to create an instance of the primitive type 'void'. This situation can only happen if an attacker was able to manipulate the incoming data, since such an instance does not exist (rhbz#1441538).
- Record
MGASA-2017-0119- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xstreamMageia:5 |
before 1.4.9-1.1.mga5 | 1.4.9-1.1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2017-0119 is a vulnerability with no CVSS score yet in xstream, published April 30, 2017. No source lists public exploit code. Fixed in xstream 1.4.9-1.1.mga5.