CVE-2016-3674

Опубликовано: 17 мая 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
Broken Link
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
Broken Link
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2822.html
Broken Link
http://rhn.redhat.com/errata/RHSA-2016-2823.html
Broken Link
http://www.debian.org/security/2016/dsa-3575
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/25/8
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/28/1
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/85381
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036419
Third Party Advisory
VDB Entry
http://x-stream.github.io/changes.html#1.4.9
Vendor Advisory
https://github.com/x-stream/xstream/issues/25
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
Broken Link
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
Broken Link
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2822.html
Broken Link
http://rhn.redhat.com/errata/RHSA-2016-2823.html
Broken Link
http://www.debian.org/security/2016/dsa-3575
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/25/8
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/28/1
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/85381
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036419
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*

Версия до 1.4.9 (исключая)

EPSS

Процентиль: 86%

0.02859

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2016-3674

CVSS3: 7.5

ubuntu

больше 9 лет назад

CVE-2016-3674

CVSS3: 5.3

redhat

почти 10 лет назад

CVE-2016-3674

CVSS3: 7.5

debian

больше 9 лет назад

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDri ...

GHSA-rgh3-987h-wpmw

CVSS3: 7.5

github

больше 5 лет назад

XML External Entity Injection in XStream

EPSS

Процентиль: 86%

0.02859

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200