CVE-2016-3674

Description

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

References

https://github.com/x-stream/xstream/issues/25

http://x-stream.github.io/changes.html#1.4.9

http://www.securitytracker.com/id/1036419

http://www.securityfocus.com/bid/85381

http://www.openwall.com/lists/oss-security/2016/03/28/1

http://www.openwall.com/lists/oss-security/2016/03/25/8

http://www.debian.org/security/2016/dsa-3575

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3