{"id":"CVE-2016-3674","aliases":["DEBIAN-CVE-2016-3674","DLA-504-1","DSA-3575-1","EUVD-2020-0513","GHSA-rgh3-987h-wpmw","MGASA-2016-0164","UBUNTU-CVE-2016-3674","USN-6978-1","openSUSE-SU-2024:10592-1"],"status":"published","title":"XML External Entity Injection in XStream","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08179,"percentile":0.949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-05-05T16:26:44Z","modified":"2026-10-20T10:49:35Z","fixes":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxstream-java","fixed_in":["1.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxstream-java","fixed_in":["1.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxstream-java","fixed_in":["1.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libxstream-java","fixed_in":["1.4.2-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libxstream-java","fixed_in":["1.4.7-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"xstream","fixed_in":["1.4.9-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"javapackages-tools","fixed_in":["4.1.0-15.1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","fixed_in":["1.4.7-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","fixed_in":["1.4.8-1ubuntu0.1+esm3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1+deb7u1"}]}],"versions":["1.4.2-1"]},{"source":"osv","ecosystem":"Debian:8","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-2+deb8u1"}]}],"versions":["1.4.7-2"]},{"source":"osv","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8"]},{"source":"osv","ecosystem":"Mageia:5","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-15.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1+esm2"}]}],"versions":["1.4.4-1","1.4.7-1","1.4.7-1ubuntu0.1","1.4.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1+esm3"}]}],"versions":["1.4.8-1","1.4.8-1ubuntu0.1","1.4.8-1ubuntu0.1+esm1","1.4.8-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1+esm2"}]}],"versions":["1.4.4-1","1.4.7-1","1.4.7-1ubuntu0.1","1.4.7-1ubuntu0.1+esm1"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1+esm3"}]}],"versions":["1.4.8-1","1.4.8-1ubuntu0.1","1.4.8-1ubuntu0.1+esm1","1.4.8-1ubuntu0.1+esm2"],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1.1"}]}],"bundled":22}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"jboss_middleware"},{"vendor":"xstream","product":"xstream"}],"references":[{"url":"http://x-stream.github.io/changes.html#1.4.9","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3575","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2822.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"http://www.securityfocus.com/bid/85381","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.securitytracker.com/id/1036419","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/28/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2823.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory","web"]},{"url":"https://github.com/x-stream/xstream/issues/25","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/25/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Broken Link","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3674","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rgh3-987h-wpmw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3674","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0164.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18277","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-3674","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3674","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6978-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-26217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21351","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39153","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3674","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2016-05-17T14:00:00Z","modified":"2026-10-08T21:03:12.795Z","updated_at":"2026-11-02T14:33:33.758954Z"}],"euvd":[{"id":"EUVD-2020-0513","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2016-05-17T14:00:00Z","modified":"2026-10-08T21:03:12Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-rgh3-987h-wpmw","title":"XML External Entity Injection in XStream","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2020-06-30T22:48:14Z","modified":"2025-05-23T19:00:04Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:44.991725Z"}],"nvd":[{"id":"CVE-2016-3674","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2016-05-17T14:08:03.607Z","modified":"2026-10-08T21:17:05.023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-3674","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2016-05-17T14:08:03.607Z","modified":"2026-10-20T10:49:35.316145603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-3674","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2016-05-17T14:08:03.607Z","modified":"2026-10-08T23:47:24.870123024Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-rgh3-987h-wpmw","title":"XML External Entity Injection in XStream","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2020-06-30T22:48:14Z","modified":"2025-05-23T19:46:42.534904Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"UBUNTU-CVE-2016-3674","description":"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.","status":"published","published":"2016-05-17T14:08:00Z","modified":"2026-02-04T02:51:07.857416Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DLA-504-1","title":"libxstream-java - security update","status":"published","published":"2016-06-06T00:00:00Z","modified":"2026-03-09T02:09:08.055539Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3575-1","title":"libxstream-java - security update","status":"published","published":"2016-05-12T00:00:00Z","modified":"2026-03-09T01:23:10.769614Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0164","title":"Updated xstream packages fix CVE-2016-3674","description":"Updated xstream packages fix security vulnerability:\n\nXStream (x-stream.github.io) is a Java library to marshal Java objects into XML\nand back. For this purpose it supports a lot of different XML parsers. Some of\nthose can also process external entities which was enabled by default. An\nattacker could therefore provide manipulated XML as input to access data on the\nfile system (CVE-2016-3674).\n","status":"published","published":"2016-05-05T16:26:44Z","modified":"2026-04-16T06:24:57.704785221Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10592-1","title":"xstream-1.4.18-1.1 on GA media","description":"These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:43.193438Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-6978-1","title":"libxstream-java vulnerabilities","description":"It was discovered that XStream incorrectly handled parsing of certain\ncrafted XML documents. A remote attacker could possibly use this issue to\nread arbitrary files. (CVE-2016-3674)\n\nZhihong Tian and Hui Lu found that XStream was vulnerable to remote code\nexecution. A remote attacker could run arbitrary shell commands by\nmanipulating the processed input stream. (CVE-2020-26217)\n\nIt was discovered that XStream was vulnerable to server-side forgery\nattacks. A remote attacker could request data from internal resources\nthat are not publicly available only by manipulating the processed input\nstream. (CVE-2020-26258)\n\nIt was discovered that XStream was vulnerable to arbitrary file deletion\non the local host. A remote attacker could use this to delete arbitrary\nknown files on the host as long as the executing process had sufficient\nrights only by manipulating the processed input stream. (CVE-2020-26259)\n\nIt was discovered that XStream was vulnerable to denial of service,\narbitrary code execution, arbitrary file deletion and server-side forgery\nattacks. A remote attacker could cause any of those issues by\nmanipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342,\nCVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346,\nCVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350,\nCVE-2021-21351)\n","status":"published","published":"2024-08-22T15:18:01Z","modified":"2026-06-29T13:51:15.787793258Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}