{"id":"CVE-2016-3674","state":"PUBLISHED","title":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriv","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","publishedAt":"2016-05-17T14:00:00.000Z","updatedAt":"2026-10-08T21:03:12.795Z","severity":null,"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["http://x-stream.github.io/changes.html#1.4.9","http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html","http://www.debian.org/security/2016/dsa-3575","http://rhn.redhat.com/errata/RHSA-2016-2822.html","http://www.securityfocus.com/bid/85381","http://www.securitytracker.com/id/1036419","http://www.openwall.com/lists/oss-security/2016/03/28/1","http://rhn.redhat.com/errata/RHSA-2016-2823.html","https://github.com/x-stream/xstream/issues/25","http://www.openwall.com/lists/oss-security/2016/03/25/8","http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"],"weaknesses":[],"ingestedAt":"2026-10-29T19:42:40.893Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2016/3xxx/CVE-2016-3674.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2016-3674","state":"PUBLISHED","datePublished":"2016-05-17T14:00:00.000Z","dateUpdated":"2026-10-08T21:03:12.795Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2016-03-28T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"http://x-stream.github.io/changes.html#1.4.9","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html","name":"FEDORA-2016-de909cc333","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.debian.org/security/2016/dsa-3575","name":"DSA-3575","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2822.html","name":"RHSA-2016:2822","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/85381","name":"85381","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1036419","name":"1036419","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/28/1","name":"[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2823.html","name":"RHSA-2016:2823","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://github.com/x-stream/xstream/issues/25","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/25/8","name":"[oss-security] 20160325 CVE request - XStream: XXE vulnerability","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html","name":"FEDORA-2016-250042b8a6","tags":["vendor-advisory","x_refsource_FEDORA"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mitre","dateUpdated":"2018-01-04T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca"},"datePublic":"2016-03-15T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-3674","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://x-stream.github.io/changes.html#1.4.9","refsource":"CONFIRM","url":"http://x-stream.github.io/changes.html#1.4.9"},{"name":"FEDORA-2016-de909cc333","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"},{"name":"DSA-3575","refsource":"DEBIAN","url":"http://www.debian.org/security/2016/dsa-3575"},{"name":"RHSA-2016:2822","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-2822.html"},{"name":"85381","refsource":"BID","url":"http://www.securityfocus.com/bid/85381"},{"name":"1036419","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1036419"},{"name":"[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2016/03/28/1"},{"name":"RHSA-2016:2823","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-2823.html"},{"name":"https://github.com/x-stream/xstream/issues/25","refsource":"CONFIRM","url":"https://github.com/x-stream/xstream/issues/25"},{"name":"[oss-security] 20160325 CVE request - XStream: XXE vulnerability","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2016/03/25/8"},{"name":"FEDORA-2016-250042b8a6","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://x-stream.github.io/changes.html#1.4.9","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html","name":"FEDORA-2016-de909cc333","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3575","name":"DSA-3575","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2822.html","name":"RHSA-2016:2822","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securityfocus.com/bid/85381","name":"85381","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1036419","name":"1036419","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/28/1","name":"[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2823.html","name":"RHSA-2016:2823","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://github.com/x-stream/xstream/issues/25","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/25/8","name":"[oss-security] 20160325 CVE request - XStream: XXE vulnerability","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html","name":"FEDORA-2016-250042b8a6","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-06T00:03:34.422Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-3674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T20:54:55.618129Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T21:03:12.795Z"}}]}}}