CVEvulnerability
CVE-2016-3674
7.5 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2016-05-17
- Last modified
- 2026-10-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Affected configurations
• redhat jboss middleware 1
• debian debian linux 8.0
• fedoraproject fedora 22
• fedoraproject fedora 23
• xstream xstream (< 1.4.9)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html Broken Link, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html Broken Link, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2822.html Broken Link
- http://rhn.redhat.com/errata/RHSA-2016-2823.html Broken Link
- http://www.debian.org/security/2016/dsa-3575 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/25/8 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/28/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/85381 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036419 Third Party Advisory, VDB Entry
- http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
- https://github.com/x-stream/xstream/issues/25 Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html Broken Link, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html Broken Link, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2822.html Broken Link
- http://rhn.redhat.com/errata/RHSA-2016-2823.html Broken Link
- http://www.debian.org/security/2016/dsa-3575 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/25/8 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/28/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/85381 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036419 Third Party Advisory, VDB Entry
- http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
- https://github.com/x-stream/xstream/issues/25 Vendor Advisory