REDHAT-BUG-1441538
First published: Wed Apr 12 2017(Updated: )
A vulnerability was found in XStream. Parsing a maliciously crafted file could cause the application to crash. The processed stream at unmarshalling type contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. The crash occurrs if this information advices XStream to create an instance of the primitive type 'void'. This situation can only happen if an attacker was able to manipulate the incoming data, since such an instance does not exist. References: <a href="http://seclists.org/oss-sec/2017/q2/9">http://seclists.org/oss-sec/2017/q2/9</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moonlight |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/oss-sec/2017/q2/9
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1441541
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1441542
- http://x-stream.github.io/CVE-2017-7957.html
- https://access.redhat.com/errata/RHSA-2017:1832
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1481373
- https://access.redhat.com/errata/RHSA-2017:2888
- https://access.redhat.com/errata/RHSA-2017:2889
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1598330
- https://bugzilla.redhat.com/show_bug.cgi?id=1441538
Frequently Asked Questions
What is the severity of REDHAT-BUG-1441538?
The severity of REDHAT-BUG-1441538 is considered to be significant due to the potential for application crashes.
How do I fix REDHAT-BUG-1441538?
To fix REDHAT-BUG-1441538, you should update XStream to the latest version where the vulnerability has been addressed.
What software is affected by REDHAT-BUG-1441538?
XStream is the affected software in the vulnerability identified by REDHAT-BUG-1441538.
What kind of attack does REDHAT-BUG-1441538 enable?
REDHAT-BUG-1441538 enables an attack where a maliciously crafted file can cause the application to crash during parsing.
How can I determine if my version of XStream is vulnerable to REDHAT-BUG-1441538?
You can determine if your version of XStream is vulnerable to REDHAT-BUG-1441538 by checking if it is an outdated version and cross-referencing with security advisories.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-7957
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xstream
- canonical/moonlight