CVE-2016-3674

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

• CWE-200

• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.htmlBroken Link, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.htmlBroken Link, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2822.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2016-2823.htmlBroken Link
• http://www.debian.org/security/2016/dsa-3575Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/03/25/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/03/28/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/85381Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036419Third Party Advisory, VDB Entry
• http://x-stream.github.io/changes.html#1.4.9Vendor Advisory
• https://github.com/x-stream/xstream/issues/25Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.htmlBroken Link, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.htmlBroken Link, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2822.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2016-2823.htmlBroken Link
• http://www.debian.org/security/2016/dsa-3575Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/03/25/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/03/28/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/85381Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036419Third Party Advisory, VDB Entry
• http://x-stream.github.io/changes.html#1.4.9Vendor Advisory
• https://github.com/x-stream/xstream/issues/25Vendor Advisory

Published

May 17, 2016

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3658The TIFFWriteDirectoryTagLongLong8Array function in tif_dirw…
• CVE-2016-3659SQL injection vulnerability in graph_view.php in Cacti 0.8.8…
• CVE-2016-3664Trend Micro Mobile Security for iOS before 3.2.1188 does not…
• CVE-2016-3670Cross-site scripting (XSS) vulnerability in users.jsp in the…
• CVE-2016-3672The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in …
• CVE-2016-3673Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-3675SQL injection vulnerability in Huawei Policy Center with sof…8.1
• CVE-2016-3676Huawei E3276s USB modems with software before E3276s-150TCPU…
• CVE-2016-3677The Huawei Wear App application before 15.0.0.307 for Androi…
• CVE-2016-3678Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switche…
• CVE-2016-3679Multiple unspecified vulnerabilities in Google V8 before 4.9…
• CVE-2016-3680Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL …