CVE-2016-3674

תיאור (מקור, אנגלית)

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

מדדים

CVSS 3.1

7.5 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — סבירות ניצול

8% (אחוזון 95) נכון ל-1 בנובמבר 2026

CWE

CWE-200

מוצרים מושפעים

redhat: jboss middleware; debian: debian linux; fedoraproject: fedora; xstream: xstream

קישורים

• http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
• https://github.com/x-stream/xstream/issues/25 Vendor Advisory
• http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
• https://github.com/x-stream/xstream/issues/25 Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html Broken LinkThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html Broken LinkThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2822.html Broken Link
• http://rhn.redhat.com/errata/RHSA-2016-2823.html Broken Link
• http://www.debian.org/security/2016/dsa-3575 Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/03/25/8 Mailing ListThird Party Advisory