what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 11 of 11 RSS Feed

CVE-2013-7285

Status Candidate

Overview

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

Related Files

Gentoo Linux Security Advisory 201612-35
Posted Dec 13, 2016
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201612-35 - A vulnerability in XStream may allow remote attackers to execute arbitrary code. Versions less than 1.4.8-r1 are affected.

tags | advisory, remote, arbitrary
systems | linux, gentoo
advisories | CVE-2013-7285
SHA-256 | 56d18fbc6f9aa211c8f675e83cb3e692698033f05c21f7982a7d8b6109c3ccf4
Red Hat Security Advisory 2015-1888-01
Posted Oct 12, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1888-01 - Red Hat JBoss SOA Platform is the next-generation ESB and business process automation infrastructure. Red Hat JBoss SOA Platform allows IT to leverage existing, modern, and future integration methodologies to dramatically improve business process execution speed and quality. It was found that the code which checked that the server hostname matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2013-7285, CVE-2014-0107, CVE-2014-0248, CVE-2014-3530, CVE-2014-3577, CVE-2014-3604
SHA-256 | 137300cf20be6442c17106059dabf78383537b44c8fef262d899c482c94adf70
Red Hat Security Advisory 2014-1059-01
Posted Aug 14, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1059-01 - JBoss Enterprise Portal Platform is the open source implementation of the Java EE suite of services and Portal services running atop JBoss Enterprise Application Platform. It comprises a set of offerings for enterprise customers who are looking for pre-configured profiles of JBoss Enterprise Middleware components that have been tested and certified together to provide an integrated experience. It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.

tags | advisory, java, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-7285, CVE-2014-0107
SHA-256 | 1f3ff00cdece96e40be750ccd8c912b91aa472d37b31ba4a80e2f2b1eae258a0
Red Hat Security Advisory 2014-1007-01
Posted Aug 5, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1007-01 - Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. This roll up patch serves as a cumulative upgrade for Red Hat JBoss BRMS 5.3.1. It includes various bug fixes. The following security issues are also fixed with this release: It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.

tags | advisory, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-7285, CVE-2014-0107
SHA-256 | d98d504697aa47b6242efe729363b71b1e6d6ea5e32959c502677616fcef87e6
Red Hat Security Advisory 2014-0452-01
Posted May 1, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0452-01 - Fuse ESB Enterprise is an integration platform based on Apache ServiceMix. Fuse MQ Enterprise, based on Apache ActiveMQ, is a standards-compliant messaging system that is tailored for use in mission critical applications. This release of Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 is an update to Fuse ESB Enterprise 7.1.0 and Fuse MQ Enterprise 7.1.0. It includes various bug fixes, which are listed in the README file included with the patch files.

tags | advisory
systems | linux, redhat
advisories | CVE-2013-6440, CVE-2013-7285, CVE-2014-0002, CVE-2014-0003, CVE-2014-0050
SHA-256 | 03f37430604f6239ba0ee36444a97249c1e5a6d314e1df68fde5bc819458ad41
Red Hat Security Advisory 2014-0389-01
Posted Apr 9, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0389-01 - The Red Hat Enterprise Virtualization reports package provides a suite of pre-configured reports and dashboards that enable you to monitor the system. The reports module is based on JasperReports and JasperServer, and can also be used to create ad-hoc reports. XStream is a simple library used by the Red Hat Enterprise Virtualization reports package to serialize and de-serialize objects to and from XML. It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.

tags | advisory, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-7285
SHA-256 | a16c938d12b5e191b973ee7db660a864e245264c8e258440a41f5ef37b3c9858
Red Hat Security Advisory 2014-0374-01
Posted Apr 3, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0374-01 - Red Hat JBoss Data Grid is a distributed in-memory data grid, based on Infinispan. This release of Red Hat JBoss Data Grid 6.2.1 serves as a replacement for Red Hat JBoss Data Grid 6.2.0. It includes various bug fixes and enhancements which are detailed in the Red Hat JBoss Data Grid 6.2.1 Release Notes.

tags | advisory
systems | linux, redhat
advisories | CVE-2013-4286, CVE-2013-7285
SHA-256 | 4fcf60b8261c41c040f82fb1df7b3976a270c863be2321569e155eae8c02a69e
Red Hat Security Advisory 2014-0372-01
Posted Apr 3, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0372-01 - Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules. This release of Red Hat JBoss BRMS 6.0.1 serves as a replacement for Red Hat JBoss BRMS 6.0.0, and includes bug fixes and enhancements.

tags | advisory
systems | linux, redhat
advisories | CVE-2011-5245, CVE-2012-0818, CVE-2013-1624, CVE-2013-6468, CVE-2013-7285, CVE-2014-0002, CVE-2014-0003
SHA-256 | 577002c736b2df2c0050d3e19a92808a039cee26aa4b4c483da50f9877b40914
Red Hat Security Advisory 2014-0371-01
Posted Apr 3, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0371-01 - Red Hat JBoss BPM Suite is a business rules management system for the management, storage, creation, modification, and deployment of JBoss rules. This release of Red Hat JBoss BPM Suite 6.0.1 serves as a replacement for Red Hat JBoss BPM Suite 6.0.0, and includes bug fixes and enhancements.

tags | advisory
systems | linux, redhat
advisories | CVE-2011-5245, CVE-2012-0818, CVE-2013-1624, CVE-2013-6468, CVE-2013-7285, CVE-2014-0002, CVE-2014-0003
SHA-256 | 99885327df8a85809381376bd6e2bb53cdb5341de4df4c673c82671d34d1a452
Red Hat Security Advisory 2014-0323-01
Posted Mar 24, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0323-01 - Red Hat JBoss Fuse 6.0.0 is an integration platform based on Apache ServiceMix. Red Hat JBoss A-MQ 6.0.0, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.0.0 and Red Hat JBoss A-MQ 6.0.0. It includes bug fixes, which are documented in the readme file included with the patch files.

tags | advisory
systems | linux, redhat
advisories | CVE-2013-7285, CVE-2014-0002, CVE-2014-0003
SHA-256 | 4033631904ad3db4b86abd7def5c87820283de0a4d5d1c79aaedd5f2366bee35
Red Hat Security Advisory 2014-0294-01
Posted Mar 14, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-0294-01 - XStream is a simple library to serialize and de-serialize objects to and from XML. It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application. The main distribution of Red Hat JBoss Data Virtualization 6.0.0 does not contain the vulnerable XStream library and is not vulnerable to CVE-2013-7285. Only users of Red Hat JBoss Data Virtualization 6.0.0 who installed an optional S-RAMP distribution as provided from the Red Hat Customer Portal are advised to apply this update.

tags | advisory, remote, arbitrary, code execution
systems | linux, redhat
advisories | CVE-2013-7285
SHA-256 | e94f90ed91b9b18863d01d1278cf19bff6faceda04aad0f5805835514be9048b
Page 1 of 1
Back1Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close