CVE-2016-3674: Infoleak

Reference Links

• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
• http://rhn.redhat.com/errata/RHSA-2016-2822.html
• http://rhn.redhat.com/errata/RHSA-2016-2823.html
• http://www.debian.org/security/2016/dsa-3575
• http://www.openwall.com/lists/oss-security/2016/03/25/8
• http://www.openwall.com/lists/oss-security/2016/03/28/1
• http://www.securityfocus.com/bid/85381
• http://www.securitytracker.com/id/1036419
• http://x-stream.github.io/changes.html#1.4.9
• https://github.com/x-stream/xstream/issues/25
• https://exchange.xforce.ibmcloud.com/vulnerabilities/111806
• https://www.ibm.com/support/pages/node/6403331 (Advisory)
• https://launchpad.net/bugs/cve/CVE-2016-3674
• https://security-tracker.debian.org/tracker/CVE-2016-3674
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3674
• https://nvd.nist.gov/vuln/detail/CVE-2016-3674
• https://ubuntu.com/security/CVE-2016-3674

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6403331

Frequently Asked Questions

• What is CVE-2016-3674?

  CVE-2016-3674 is a vulnerability in XStream that allows remote attackers to read arbitrary files via a crafted XML document.

• What causes CVE-2016-3674 vulnerability?

  CVE-2016-3674 is caused by multiple XML external entity (XXE) vulnerabilities in the XStream drivers.

• How can an attacker exploit CVE-2016-3674?

  An attacker can exploit CVE-2016-3674 by sending a crafted XML document to the target system.

• Which software versions are affected by CVE-2016-3674?

  Versions up to and including 1.4.8 of XStream and up to version 3.0.0.2 of IBM GDE are affected by CVE-2016-3674.

• What is the severity of CVE-2016-3674?

  The severity of CVE-2016-3674 is high, with a CVSS score of 7.5.