Post Content
Category Archives: Advisories
GLSA 202301-05: Apache Commons Text: Arbitrary Code Execution
GLSA 202301-04: jupyter_core: Arbitrary Code Execution
GLSA 202301-03: scikit-learn: Denial of Service
GLSA 202301-02: Twisted: Multiple Vulnerabilities
GLSA 202301-01: NTFS-3G: Multiple Vulnerabilities
DSA-5313 hsqldb – security update
It was found that those using java.sql.Statement or java.sql.PreparedStatement
in hsqldb, a Java SQL database, to process untrusted input may be vulnerable to
a remote code execution attack. By default it is allowed to call any static
method of any Java class in the classpath resulting in code execution. The
issue can be prevented by updating to 2.5.1-1+deb11u1 or by setting the system
property hsqldb.method_class_names to classes which are allowed to be called.
For example, System.setProperty(“hsqldb.method_class_names”,”abc”) or Java
argument -Dhsqldb.method_class_names=”abc” can be used. From version
2.5.1-1+deb11u1 all classes by default are not accessible except those in
java.lang.Math and need to be manually enabled.
DSA-5312 libjettison-java – security update
Several flaws have been discovered in libjettison-java, a collection of StAX
parsers and writers for JSON. Specially crafted user input may cause a denial
of service via out-of-memory or stack overflow errors.
DSA-5316 netty – security update
Several out-of-memory, stack overflow or HTTP request smuggling vulnerabilities
have been discovered in Netty, a Java NIO client/server socket framework, which
may allow attackers to cause a denial of service or bypass restrictions when
used as a proxy.
DSA-5315 libxstream-java – security update
XStream serializes Java objects to XML and back again. Versions prior to
1.4.15-3+deb11u2 may allow a remote attacker to terminate the application with
a stack overflow error, resulting in a denial of service only via manipulation
of the processed input stream. The attack uses the hash code implementation for
collections and maps to force recursive hash calculation causing a stack
overflow. This update handles the stack overflow and raises an
InputManipulationException instead.