CVE-2016-3674

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.htmlBroken Link, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2822.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2016-2823.htmlBroken Link
http://www.debian.org/security/2016/dsa-3575Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/25/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/28/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/85381Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036419Third Party Advisory, VDB Entry
http://x-stream.github.io/changes.html#1.4.9Vendor Advisory
https://github.com/x-stream/xstream/issues/25Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.htmlBroken Link, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2822.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2016-2823.htmlBroken Link
http://www.debian.org/security/2016/dsa-3575Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/25/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/28/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/85381Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036419Third Party Advisory, VDB Entry
http://x-stream.github.io/changes.html#1.4.9Vendor Advisory
https://github.com/x-stream/xstream/issues/25Vendor Advisory

Timeline

Published: May 17, 2016
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2016

CVE-2016-36758.1SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbi CVE-2016-36766.4Huawei E3276s USB modems with software before E3276s-150TCPU-V200R002B436D09SP00C00 allow man-in-the-middle attackers to intercept, spoof, o CVE-2016-36776.5The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecifi CVE-2016-36787.5Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 allow remote attackers to cause a denial o CVE-2016-36798.8Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause CVE-2016-36807.8Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17 CVE-2016-36817.8Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17 CVE-2016-36844.7SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to CVE-2016-36854.7SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context CVE-2016-36865.9The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote at CVE-2016-36875.3Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-CVE-2016-36886.5SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to d