CVE-2013-7285
Fixed in a distro release EPSS 84%
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Products: oracle endeca_information_discovery_studio, apache activemq, xstream
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | 1.4.7 |
| Maven | com.thoughtworks.xstream:xstream | 1.4.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libxstream-java | 1.4.7-1 |
| Debian 13 | libxstream-java | 1.4.7-1 |
| Debian 14 | libxstream-java | 1.4.7-1 |
| Red Hat rhev manager 3 | jasperreports-server-pro | 0:5.5.0-6.el6ev |
| Ubuntu 14.04 LTS | libxstream-java | 1.4.7-1 |