File xstream.changes of Package xstream.19902

Overview Repositories Revisions Requests Users Attributes Meta

File xstream.changes of Package xstream.19902

-------------------------------------------------------------------
Mon May 31 07:59:25 UTC 2021 - Fridrich Strba <fstrba@suse.com>

- Upgrade to 1.4.17
  * Security fix:
    * bsc#1186651, CVE-2021-29505: potential code execution when
      unmarshalling with XStream instances using an uninitialized
      security framework

-------------------------------------------------------------------
Thu Apr 15 14:31:31 UTC 2021 - Fridrich Strba <fstrba@suse.com>

- Upgrade to 1.4.16
  * Security fixes:
    + bsc#1184796, CVE-2021-21351: remote attacker to load and
      execute arbitrary code
    + bsc#1184797, CVE-2021-21349: SSRF can lead to a remote
      attacker to request data from internal resources
    + bsc#1184380, CVE-2021-21350: arbitrary code execution
    + bsc#1184374, CVE-2021-21348: remote attacker could cause
      denial of service by consuming maximum CPU time
    + bsc#1184378, CVE-2021-21347: remote attacker to load and
      execute arbitrary code from a remote host
    + bsc#1184375, CVE-2021-21344: remote attacker could load and
      execute arbitrary code from a remote host
    + bsc#1184379, CVE-2021-21342: server-side forgery
    + bsc#1184377, CVE-2021-21341: remote attacker could cause a
      denial of service by allocating 100% CPU time
    + bsc#1184373, CVE-2021-21346: remote attacker could load and
      execute arbitrary code
    + bsc#1184372, CVE-2021-21345: remote attacker with sufficient
      rights could execute commands
    + bsc#1184376, CVE-2021-21343: replace or inject objects, that
      result in the deletion of files on the local host
- Add patch:
  * Revert-MXParser-changes.patch
    + revert changes that would force us to add new dependency

-------------------------------------------------------------------
Tue Mar  9 16:16:01 UTC 2021 - Johannes Renner <jrenner@suse.com>

- Upgrade to 1.4.15
  * fixes bsc#1180146, CVE-2020-26258 and bsc#1180145,
    CVE-2020-26259
- Upgrade to 1.4.14
  * fixes bsc#1180994, CVE-2020-26217
- Update xstream to 1.4.15~susemanager
  Removed:
  * xstream_1_4_10-jdk11.patch
  * xstream_1_4_10-buildsh-sle12.patch
  * build.sh

-------------------------------------------------------------------
Tue Mar  5 15:43:30 UTC 2019 - Frantisek Kobzik <fkobzik@suse.com>

- Update xstream to 1.4.10
  Added:
  * xstream_1_4_10-jdk11.patch
  * xstream_1_4_10-buildsh-sle12.patch
  * xstream-XSTREAM_1_4_10.tar.gz
  Removed:
  * 0001-Prevent-deserialization-of-void.patch
  * xstream-XSTREAM_1_4_9.tar.gz
  * xstream-XSTREAM_1_4_9-jdk11.patch

- Major changes:
- New XStream artifact with -java7 appended as version suffix for a library explicitly without the Java 8 stuff (lambda expression support, converters for java.time.* package).
- Fix PrimitiveTypePermission to reject type void to prevent CVE-2017-7957 with an initialized security framework.
- Improve performance by minimizing call stack of mapper chain.
- XSTR-774: Add converters for types of java.time, java.time.chrono, and java.time.temporal packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora).
- JavaBeanConverter does not respect ignored unknown elements.
- Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x.
- Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to known exploits.

-------------------------------------------------------------------
Tue Feb  5 17:29:18 UTC 2019 - michele.bologna@suse.com

- Feat: modify patch to be compatible with JDK 11 building
  Added:
  * xstream-XSTREAM_1_4_9-jdk11.patch
  Removed:
  * xstream-XSTREAM_1_4_9-jdk9.patch

-------------------------------------------------------------------
Tue Dec 11 15:27:00 UTC 2018 - moio@suse.com

- fixes for SLE 15 compatibility

-------------------------------------------------------------------
Fri Dec  1 13:22:06 UTC 2017 - mc@suse.com

- fix possible Denial of Service when unmarshalling void.
  (CVE-2017-7957, bsc#1070731)
  Added:
  * 0001-Prevent-deserialization-of-void.patch

-------------------------------------------------------------------
Tue Nov  7 14:04:11 UTC 2017 - jgonzalez@suse.com

- Fix build for JDK9
- Disable javadoc generation (broken for SLE15 and Tumbleweed)
- Add:
  * xstream-XSTREAM_1_4_9-jdk9.patch
- Changed:
  * build.sh

-------------------------------------------------------------------
Tue Apr  5 21:17:09 UTC 2016 - moio@suse.com

- Require building on Java 8, otherwise the LambdaMapper class is skipped
(issue 30)

-------------------------------------------------------------------
Tue Mar 29 12:50:05 UTC 2016 - moio@suse.com

- Upgrade to version 1.4.9, which fixes CVE-2016-3674 (bsc#972950)

-------------------------------------------------------------------
Tue Nov 10 07:25:59 UTC 2015 - moio@suse.com

- Initial version

Places

File xstream.changes of Package xstream.19902

Places