Vulnerability-Lookup

USN-5946-1 (UBUNTU-CVE-2021-39139)

Vulnerability from osv_ubuntu – Published: 2023-03-13 10:57 – Updated: 2026-06-29 10:53 – Source website

Summary

libxstream-java vulnerabilities

Details

Lai Han discovered that XStream incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39140)

It was discovered that XStream incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145, CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149, CVE-2021-39151, CVE-2021-39153, CVE-2021-39154)

It was discovered that XStream incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39150, CVE-2021-39152)

References

URL

Type

	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://ubuntu.com/security/CVE-2021-39139	REPORT
	https://ubuntu.com/security/CVE-2021-39140	REPORT
	https://ubuntu.com/security/CVE-2021-39141	REPORT
	https://ubuntu.com/security/CVE-2021-39144	REPORT
	https://ubuntu.com/security/CVE-2021-39145	REPORT
	https://ubuntu.com/security/CVE-2021-39146	REPORT
	https://ubuntu.com/security/CVE-2021-39147	REPORT
	https://ubuntu.com/security/CVE-2021-39148	REPORT
	https://ubuntu.com/security/CVE-2021-39149	REPORT
	https://ubuntu.com/security/CVE-2021-39150	REPORT
	https://ubuntu.com/security/CVE-2021-39151	REPORT
	https://ubuntu.com/security/CVE-2021-39152	REPORT
	https://ubuntu.com/security/CVE-2021-39153	REPORT
	https://ubuntu.com/security/CVE-2021-39154	REPORT
	https://ubuntu.com/security/CVE-2022-41966	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-41966",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.7-1ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.7-1ubuntu0.1+esm1?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.7-1ubuntu0.1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.4-1",
        "1.4.7-1",
        "1.4.7-1ubuntu0.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-41966",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.8-1ubuntu0.1+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.8-1ubuntu0.1+esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.8-1ubuntu0.1+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.8-1",
        "1.4.8-1ubuntu0.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-39139",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39140",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39141",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39144",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39145",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39146",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39147",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39148",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39149",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39150",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39151",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39152",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39153",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39154",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-41966",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-39139",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39140",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39141",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39144",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39145",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39146",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39147",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39148",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39149",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39150",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39151",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39152",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39153",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-39154",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-41966",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-41966",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.18-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.18-2ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.18-2ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.15-4",
        "1.4.18-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Lai Han discovered that XStream incorrectly handled certain inputs.\nIf a user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2021-39140)\n\nIt was discovered that XStream incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04\nLTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,\nCVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149,\nCVE-2021-39151, CVE-2021-39153, CVE-2021-39154)\n\nIt was discovered that XStream incorrectly handled certain inputs. If\na user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2021-39150, CVE-2021-39152)\n\nLai Han discovered that XStream incorrectly handled certain inputs.\nIf a user or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to cause a denial\nof service. (CVE-2022-41966)\n",
  "id": "USN-5946-1",
  "modified": "2026-06-29T10:53:00Z",
  "published": "2023-03-13T10:57:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39139"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39140"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39141"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39144"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39145"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39146"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39147"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39148"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39149"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39150"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39151"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39152"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39153"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39154"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-41966"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "libxstream-java vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-39139",
    "UBUNTU-CVE-2021-39140",
    "UBUNTU-CVE-2021-39141",
    "UBUNTU-CVE-2021-39144",
    "UBUNTU-CVE-2021-39145",
    "UBUNTU-CVE-2021-39146",
    "UBUNTU-CVE-2021-39147",
    "UBUNTU-CVE-2021-39148",
    "UBUNTU-CVE-2021-39149",
    "UBUNTU-CVE-2021-39150",
    "UBUNTU-CVE-2021-39151",
    "UBUNTU-CVE-2021-39152",
    "UBUNTU-CVE-2021-39153",
    "UBUNTU-CVE-2021-39154",
    "UBUNTU-CVE-2022-41966"
  ]
}

UBUNTU-CVE-2021-39139 (CVE-2021-39139)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39139	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39139.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39139	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39139",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39139"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39139.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39139"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39139"
  ]
}

UBUNTU-CVE-2021-39140 (CVE-2021-39140)

Vulnerability from osv_ubuntu – Published: 2021-08-23 19:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

6.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39140	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39140.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39140	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39140",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39140"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxcc"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39140.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39140"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39140"
  ]
}

UBUNTU-CVE-2021-39141 (CVE-2021-39141)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39141	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39141.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39141	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39141",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39141"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39141.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39141"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39141"
  ]
}

UBUNTU-CVE-2021-39144 (CVE-2021-39144)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39144	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39144.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39144	REPORT
	https://www.cisa.gov/known-exploited-vulnerabilit…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39144",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39144"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39144.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39144"
    },
    {
      "type": "REPORT",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39144"
  ]
}

UBUNTU-CVE-2021-39145 (CVE-2021-39145)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39145	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39145.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39145	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39145",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39145"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-8jrj-525p-826v"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39145.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39145"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39145"
  ]
}

UBUNTU-CVE-2021-39146 (CVE-2021-39146)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39146	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39146.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39146	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39146",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39146"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-p8pq-r894-fm8f"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39146.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39146"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39146"
  ]
}

UBUNTU-CVE-2021-39147 (CVE-2021-39147)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39147	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39147.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39147	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39147",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39147"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39147.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39147"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39147"
  ]
}

UBUNTU-CVE-2021-39148 (CVE-2021-39148)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39148	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39148.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39148	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39148",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39148"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-qrx8-8545-4wg2"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39148.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39148"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39148"
  ]
}

UBUNTU-CVE-2021-39149 (CVE-2021-39149)

Vulnerability from osv_ubuntu – Published: 2021-08-23 18:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39149	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39149.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39149	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
  "id": "UBUNTU-CVE-2021-39149",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39149"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39149.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39149"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39149"
  ]
}

UBUNTU-CVE-2021-39150 (CVE-2021-39150)

Vulnerability from osv_ubuntu – Published: 2021-08-23 19:15 – Updated: 2025-07-16 04:57 – Source website

Details

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18.

Severity

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-39150	REPORT
	https://github.com/x-stream/xstream/security/advi…	REPORT
	https://x-stream.github.io/CVE-2021-39150.html	REPORT
	https://ubuntu.com/security/notices/USN-5946-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-39150	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1+deb10u4build0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1+deb10u4build0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1+deb10u4build0.18.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.10-1",
        "1.4.11.1-1~18.04",
        "1.4.11.1-1~18.04.1",
        "1.4.11.1-1~18.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libxstream-java",
            "binary_version": "1.4.11.1-1ubuntu0.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libxstream-java",
        "purl": "pkg:deb/ubuntu/libxstream-java@1.4.11.1-1ubuntu0.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.11.1-1ubuntu0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.11.1-1",
        "1.4.11.1-1ubuntu0.1",
        "1.4.11.1-1ubuntu0.2"
      ]
    }
  ],
  "aliases": [],
  "details": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.",
  "id": "UBUNTU-CVE-2021-39150",
  "modified": "2025-07-16T04:57:28Z",
  "published": "2021-08-23T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-39150"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp"
    },
    {
      "type": "REPORT",
      "url": "https://x-stream.github.io/CVE-2021-39150.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5946-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39150"
    }
  ],
  "related": [
    "USN-5946-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-39150"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

USN-5946-1 (UBUNTU-CVE-2021-39139)

UBUNTU-CVE-2021-39139 (CVE-2021-39139)

UBUNTU-CVE-2021-39140 (CVE-2021-39140)

UBUNTU-CVE-2021-39141 (CVE-2021-39141)

UBUNTU-CVE-2021-39144 (CVE-2021-39144)

UBUNTU-CVE-2021-39145 (CVE-2021-39145)

UBUNTU-CVE-2021-39146 (CVE-2021-39146)

UBUNTU-CVE-2021-39147 (CVE-2021-39147)

UBUNTU-CVE-2021-39148 (CVE-2021-39148)

UBUNTU-CVE-2021-39149 (CVE-2021-39149)

UBUNTU-CVE-2021-39150 (CVE-2021-39150)

Tags

Sightings

Nomenclature

Related by attack behaviour