Published: 17/05/2016 Updated: 26/03/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream prior to 1.4.9 allow remote malicious users to read arbitrary files via a crafted XML document.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
fedoraproject fedora 22
fedoraproject fedora 23
xstream project xstream

Debian Bug report logs - #819455 libxstream-java: CVE-2016-3674: XXE vulnerability Package: src:libxstream-java; Maintainer for src:libxstream-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 28 Mar 2016 18:48:02 UTC Sever ...

It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks For the stable distribution (jessie), this problem has been fixed in version 147-2+deb8u1 For the testing distribution (stretch), this problem has been fixed in version 149-1 For the unstable distribution ...

It was found that several XML parsers used by XStream had default settings that would expand entity references A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks ...

CWE-200 http://www.openwall.com/lists/oss-security/2016/03/25/8 http://www.debian.org/security/2016/dsa-3575 http://x-stream.github.io/changes.html#1.4.9 https://github.com/x-stream/xstream/issues/25 http://www.openwall.com/lists/oss-security/2016/03/28/1 http://www.securityfocus.com/bid/85381 http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html http://www.securitytracker.com/id/1036419 http://rhn.redhat.com/errata/RHSA-2016-2823.html http://rhn.redhat.com/errata/RHSA-2016-2822.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819455 https://www.debian.org/security/./dsa-3575 https://nvd.nist.gov

CVE-2016-3674

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect