Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
- https://github.com/x-stream/xstream/issues/25 Vendor Advisory
- http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
- https://github.com/x-stream/xstream/issues/25 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · redhat, debian, fedoraprojectNVD modified 2026-10-08 21:17
Affected (CPE criteria) 5
cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*
References 22
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html Broken Link, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html Broken Link, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2822.html Broken Link
- http://rhn.redhat.com/errata/RHSA-2016-2823.html Broken Link
- http://www.debian.org/security/2016/dsa-3575 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/25/8 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/28/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/85381 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036419 Third Party Advisory, VDB Entry
- http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
- https://github.com/x-stream/xstream/issues/25 Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html Broken Link, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html Broken Link, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2822.html Broken Link
- http://rhn.redhat.com/errata/RHSA-2016-2823.html Broken Link
- http://www.debian.org/security/2016/dsa-3575 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/25/8 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/03/28/1 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/85381 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036419 Third Party Advisory, VDB Entry
- http://x-stream.github.io/changes.html#1.4.9 Vendor Advisory
- https://github.com/x-stream/xstream/issues/25 Vendor Advisory