CVE-2017-7957

Опубликовано: 29 апр. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("") call.

Ссылки

http://www.debian.org/security/2017/dsa-3841
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/100687
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039499
Broken Link
Third Party Advisory
VDB Entry
http://x-stream.github.io/CVE-2017-7957.html
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1832
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2888
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2889
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/125800
Third Party Advisory
VDB Entry
https://www-prd-trops.events.ibm.com/node/715749
Broken Link
Permissions Required
http://www.debian.org/security/2017/dsa-3841
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/100687
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039499
Broken Link
Third Party Advisory
VDB Entry
http://x-stream.github.io/CVE-2017-7957.html
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1832
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2888
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2889
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/125800
Third Party Advisory
VDB Entry
https://www-prd-trops.events.ibm.com/node/715749
Broken Link
Permissions Required

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*

Версия до 1.4.9 (включая)

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 92%

0.04928

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2017-7957

CVSS3: 7.5

ubuntu

больше 9 лет назад

CVE-2017-7957

CVSS3: 5.9

redhat

больше 9 лет назад

CVE-2017-7957

CVSS3: 7.5

debian

больше 9 лет назад

XStream through 1.4.9, when a certain denyTypes workaround is not used ...

GHSA-7hwc-46rm-65jh

CVSS3: 7.5

github

больше 6 лет назад

Denial of service in XStream

ALT-PU-2019-4251

CVSS3: 7.5

altlinux

больше 7 лет назад

ALT-PU-2019-4251: package `xstream` update to version 1.4.11.1-alt1_2jpp8

EPSS

Процентиль: 92%

0.04928

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-20