Vulnerability Bulletins |
DSA-4619 libxmlrpc3-java - security update |
|
| Affected software | Debian |
|
Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java,an XML-RPC implementation in Java, does perform deserialization of theserver-side exception serialized in the faultCause attribute of XMLRPCerror response messages. A malicious XMLRPC server can take advantage ofthis flaw to execute arbitrary code with the privileges of anapplication using the Apache XMLRPC client library. More info: https://www.debian.org/security/2020/dsa-4619 |
|