Description
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
References (11)
Core 11
Core References
Broken Link, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3575
Broken Link vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2822.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/85381
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/03/28/1
Broken Link vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2823.html
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/03/25/8
Broken Link, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
Vendor Advisory x_refsource_confirm
http://x-stream.github.io/changes.html#1.4.9
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1036419
Vendor Advisory x_refsource_confirm
https://github.com/x-stream/xstream/issues/25
Scores
CVSS v3
7.5
EPSS
0.0818
EPSS Percentile
94.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (6)
com.thoughtworks.xstream/xstream
0 - 1.4.9Maven
debian/debian_linux
8.0
fedoraproject/fedora
22
fedoraproject/fedora
23
redhat/jboss_middleware
1
xstream/xstream
< 1.4.9
Published
May 17, 2016
Tracked Since
Feb 18, 2026