--===============7002691957478472999==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="26dnkanc5dbfzfd3"
Content-Disposition: inline


--26dnkanc5dbfzfd3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-4714-1
January 28, 2021

libxstream-java vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in libxstream-java.

Software Description:
- libxstream-java: Java library to serialize objects to XML and back again

Details:

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code
execution. A remote attacker could run arbitrary shell commands by
manipulating the processed input stream. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks.
A remote attacker could request data from internal resources that are not
publicly available only by manipulating the processed input stream.
(CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on
the local host. A remote attacker could use this to delete arbitrary known
files on the host as long as the executing process had sufficient rights only
by manipulating the processed input stream. (CVE-2020-26259)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  libxstream-java                 1.4.11.1-1ubuntu0.1

Ubuntu 18.04 LTS:
  libxstream-java                 1.4.11.1-1~18.04.1

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4714-1
  CVE-2020-26217, CVE-2020-26258, CVE-2020-26259

Package Information:
  https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-1ubuntu0.1
  https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-1~18.04.1

--26dnkanc5dbfzfd3
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAmATK1IACgkQbUp5kL3i
zGZC8g/+MfSK3tj2qGrmbbTkQzQ5Q2LUuZ2bA+xdKgpliVzzASmwXeqiIU2rQcm6
iNCEopaFzIGwvVjZiDi4N9wUBazz7EpQHaaeKRvM7mp+AXvUPNHBoXB1i1kLzEFf
wz04xsK0tT97VZWER11NnFzbiDEeYyD9f27dXehdfNriRp3D/3LxKPXVLm3X57WL
MjQb3+YIA4fczTCS0on2pM5uiHbAy4MsYqOFzPEIHuZVeXUVeQ6dDNfn0pYRgpNg
YAJ9RkI9qKaeVeE9vlZ9ktYBY0Rrbe8ws6gx5jC80j9YWrBh3nDI2+XuRb8s9sV5
OKmsdVVLtW+9AUGWN3EJ47hpOqfYyWmbVov+/Z18lXHaiy+BntE4QRfkV1U13GBL
Q4sA+4mf1sjMCgHU/8AiQziK0Sh9VMOD1SqTjGeIGG6zSCJuGiUsWERECWVkaG7e
MEaXa1KFfnIa51fVlDfK6NcPDPIUp4P5JHJluF9beiEBeolHh67fD+SCRQn+pDUn
SeNwaeOVFzhqqKM875aejdI6DxUFUSYg6l5MzAFbEA6TmjXColdnH6qABSYOOymo
tqq7MsGfHCCjOz8a8Vz463/JHpSOqx1xXbDw/mVEQ8A7TyIw/YqgqjSBAZFVWejO
m0zdFpUvuP533M83QfvL02K8dXICz584AU7Re1qLvoBSmg1X/Ys=
=N+yT
-----END PGP SIGNATURE-----

--26dnkanc5dbfzfd3--


--===============7002691957478472999==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce