Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2017-7957

Description

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("") call.

POC

Reference

No PoCs from references.

Github

- https://github.com/A-TPL-Bench/LibHunter

- https://github.com/ARPSyndicate/cvemon

- https://github.com/Anonymous-Phunter/PHunter

- https://github.com/CGCL-codes/LibHunter

- https://github.com/CGCL-codes/PHunter

- https://github.com/LibHunter/LibHunter

- https://github.com/OpenLabSE/VulFinder

- https://github.com/VulFinder/VulFinder

- https://github.com/Whoopsunix/PPPVULNS

- https://github.com/dotanuki-labs/android-oss-cves-research

- https://github.com/lmarso-asapp/kotlin-unsecure

- https://github.com/nekuroporisu/android-oss-cves-research

- https://github.com/pkrajanand/xstream_v1_4_11_security_issues

- https://github.com/pkrajanand/xstream_v1_4_9_security_issues

- https://github.com/pocmigrator/VulEUT

- https://github.com/x-poc/xstream-poc