Vulnerability Description
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Jboss Middleware | 1 |
| Debian | Debian Linux | 8.0 |
| Fedoraproject | Fedora | 22 |
| Xstream | Xstream | < 1.4.9 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.htmlBroken LinkThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.htmlBroken LinkThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2822.htmlBroken Link
- http://rhn.redhat.com/errata/RHSA-2016-2823.htmlBroken Link
- http://www.debian.org/security/2016/dsa-3575Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/25/8Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/28/1Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/85381Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1036419Third Party AdvisoryVDB Entry
- http://x-stream.github.io/changes.html#1.4.9Vendor Advisory
- https://github.com/x-stream/xstream/issues/25Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.htmlBroken LinkThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.htmlBroken LinkThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2822.htmlBroken Link
- http://rhn.redhat.com/errata/RHSA-2016-2823.htmlBroken Link
FAQ
What is CVE-2016-3674?
CVE-2016-3674 is a vulnerability with a CVSS score of 7.5 (HIGH). Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStrea...
How severe is CVE-2016-3674?
CVE-2016-3674 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-3674?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Jboss Middleware, Debian Debian Linux, Fedoraproject Fedora, Xstream Xstream.