CVE-2016-3674
Fixed in a distro release EPSS 8%
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Products: redhat jboss_middleware, debian_linux, fedoraproject fedora, xstream
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | 1.4.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libxstream-java | 1.4.9-1 |
| Debian 13 | libxstream-java | 1.4.9-1 |
| Debian 14 | libxstream-java | 1.4.9-1 |
| Debian 7 | libxstream-java | 1.4.2-1+deb7u1 |
| Debian 8 | libxstream-java | 1.4.7-2+deb8u1 |
| Ubuntu Pro 14.04 LTS | libxstream-java | 1.4.7-1ubuntu0.1+esm2 |
| Ubuntu Pro 16.04 LTS | libxstream-java | 1.4.8-1ubuntu0.1+esm3 |
| openSUSE Tumbleweed | xstream | 1.4.18-1.1 |