Debian LTS: Security Advisory for libxstream-java (DLA-2507-1)

The remote host is missing an update for the 'libxstream-java' package(s) announced via the DLA-2507-1 advisory.

Several security vulnerabilities were discovered in XStream, a Java library to serialize objects to XML and back again. CVE-2020-26258 XStream is vulnerable to a Server-Side Forgery Request which can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. CVE-2020-26259 Xstream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary known files on the host as long as the executing process has sufficient rights only by manipulating the processed input stream.

'libxstream-java' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 stretch, these problems have been fixed in version 1.4.11.1-1+deb9u1. We recommend that you upgrade your libxstream-java packages.