--===============2770039776185299419== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="niaie5t4nhnpyzi4" Content-Disposition: inline
--niaie5t4nhnpyzi4 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
========================================================================== Ubuntu Security Notice USN-4943-1 May 11, 2021
libxstream-java vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.04 - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in XStream library.
Software Description: - libxstream-java: Java library to serialize objects to XML and back again
Details:
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. This issue affected only affected Ubuntu 20.10. (CVE-2020-26217)
It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26258)
It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26259)
It was discovered that XStream was vulnerable to denial of service, arbitrary code execution, arbitrary file deletion and server-side forgery attacks. A remote attacker could cause any of those issues by manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343 CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.04: libxstream-java 1.4.15-1ubuntu0.1
Ubuntu 20.10: libxstream-java 1.4.11.1-2ubuntu0.1
Ubuntu 20.04 LTS: libxstream-java 1.4.11.1-1ubuntu0.2
Ubuntu 18.04 LTS: libxstream-java 1.4.11.1-1~18.04.2
In general, a standard system update will make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-4943-1 CVE-2020-26217, CVE-2020-26258, CVE-2020-26259, CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351
Package Information: https://launchpad.net/ubuntu/+source/libxstream-java/1.4.15-1ubuntu0.1 https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-2ubuntu0.1 https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-1ubuntu0.2 https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-1~18.04.2
--niaie5t4nhnpyzi4 Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEECtyyz6azUy6AZBzSkGeI6zGnN/8FAmCaaCcACgkQkGeI6zGn N/9ggw/+Jah2EOqgpU51EjNQYNSpx23jSLG2sm6/4uhMGlKTLyQelgONdk943Zvr NDUssQaQBW33I93b6xdMwGTxZkpUIwYOCcOVw1QjJg2cd1LR458ovscMNmSQOPsz k39XPds4nwSqY6sm4ycLQ8xdeUVWxnym0y3oLVf1/1rpCKuvFpcMICJ+j21z78Bc H7tsBwXJ9LyXPzCfM0cCRbMa2TXxDDT3YTokPVtuo8I3umwl54E9kXpJj4a4tzWF tQ9LOqSxgBWm/uNwhsKnqSPiGCwQFEcUaQwzGiIRfQ2iwG7lMG+NTE6wi1NVOpo5 3cGKAdaB+oJBm3LYq7/8IAXTOkEI7YOKWR8M7elhBZMxiGinycXBN6zLzN09geAp fav1gw9waiXs0dAEJKHzUKxShu9aEocqggOw8z4ll5Rnge99h543ZMDwnr0Nbzea A01eqUXJ28yLbK/ZfX7e03/Lf8g2CkJeweR0wc3ZUROvaB6hkHvjR4C3FVFsVFsG iegHRDCoMJSipMWB0DdsDpbUamlRnAH1bfAOcA2lev05oLuoErgjJd0bYBQe1iIY MLltfqVsTy+3Hlye+mGaW9uD2o8PW0J6yTL3FlTiRkI7a5BDhzOVXQXDxbJmoR9A ZJAdiaQ1Lk4XUyj+rH1APuU4ZbvwWsuy4gG4rUcDVtxGcqF7AUE= =k593 -----END PGP SIGNATURE-----
--niaie5t4nhnpyzi4--
--===============2770039776185299419== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
|