libxstream-java: XStream is a Java library to serialize objects to XML and back again

XStream is a Java library to serialize objects to XML and back again. InXStream before version 1.4.16, there is a vulnerability where the processedstream at unmarshalling time contains type information to recreate theformerly written objects. XStream creates therefore new instances based onthese type information. An attacker can manipulate the processed inputstream and replace or inject objects, that result in the deletion of a fileon the local host. No user is affected, who followed the recommendation tosetup XStream's security framework with a whitelist limited to the minimalrequired types. If you rely on XStream's default blacklist of the SecurityFramework, you will have to use at least version 1.4.16.

Where it's fixed