CVE-2017-7957: debian debian_linux Improper Input Validation
CVSS: 7.5v3.1HighAnalyzed
AliasesSUSE-RU-2019:1006-1SUSE-SU-2017:3389-1SUSE-SU-2017:3390-1SUSE-SU-2019:1006-1UBUNTU-CVE-2017-7957DEBIAN-CVE-2017-7957DLA-930-1DSA-3841-1CGA-25xw-cvc9-ggxxCGA-2mx8-h7mx-pjpqGHSA-7hwc-46rm-65jhCGA-vcjw-gmfm-794gCGA-xp53-8h5w-3qw2
Published 29-04-2017Last modified 08-10-2026
Vulnerability summary
CVE-2017-7957 is a high (CVSS 7.5) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 4.93% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
4.93%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 29-04-2017PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
CVSS metrics
7 scores · 5 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.93%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.93% on 18-09-2026
18-09-202618-10-2026
EPSS score4.93%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse29 products
- apache-commons-lang3&distro=SUSE Manager Server 3.2< 3.4-3.3.3
- cobbler&distro=SUSE Manager Server 3.2< 2.6.6-6.16.3
- drools&distro=SUSE Manager Server 3.2< 7.17.0-3.3.3
- guava&distro=SUSE Manager Server 3.2< 27.0.1-3.3.3
- jade4j&distro=SUSE Manager Server 3.2< 1.0.7-3.3.3
Chainguard2 products
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
Debian2 products
- libxstream-java< 1.4.9-2 | < 1.4.7-2+deb8u2 | < 1.4.2-1+deb7u2
- debian_linuxEOL8.0 | 9.0
Redhat2 products
Com.thoughtworks.xstream1 product
- xstream< 1.4.10
Ubuntu1 product
- libxstream-java< 1.4.7-1ubuntu0.1 | < 1.4.8-1ubuntu0.1
Xstream1 product
- xstream≤ 1.4.9
7 vendors · 38 products
References
49 links- access.redhat.com/errata/RHSA-2017:2888Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2017:1832Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2889Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- www.securitytracker.com/id/1039499VDB EntryX Refsource SECTRACKBroken LinkThird Party AdvisoryAdvisoryWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/125800VDB EntryX Refsource XFThird Party AdvisoryAdvisoryWEB
www.debian.org/security/2017/dsa-3841Vendor AdvisoryX Refsource DEBIANMailing ListThird Party AdvisoryAdvisoryWEB
Show all 49 references
- github.com/x-stream/xstreamPACKAGE