CVE-2024-47072

Name	CVE-2024-47072
Description	XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1087274

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libxstream-java (PTS)	jessie, jessie (lts)	1.4.11.1-1+deb8u6	vulnerable
	stretch (security)	1.4.11.1-1+deb9u5	vulnerable
	stretch (lts), stretch	1.4.11.1-1+deb9u6	vulnerable
	buster (security), buster, buster (lts)	1.4.11.1-1+deb10u4	vulnerable
	bullseye (security), bullseye	1.4.15-3+deb11u2	vulnerable
	bookworm	1.4.20-1	vulnerable
	sid, trixie	1.4.21-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libxstream-java	source	stretch	(unfixed)	end-of-life
libxstream-java	source	(unstable)	1.4.21-1			1087274

https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q
https://x-stream.github.io/CVE-2024-47072.html