Description (CNA)
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://x-stream.github.io/changes.html#1.4.9
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
- http://www.debian.org/security/2016/dsa-3575
- http://rhn.redhat.com/errata/RHSA-2016-2822.html
- http://www.securityfocus.com/bid/85381
- http://www.securitytracker.com/id/1036419
- http://www.openwall.com/lists/oss-security/2016/03/28/1
- http://rhn.redhat.com/errata/RHSA-2016-2823.html
- https://github.com/x-stream/xstream/issues/25
- http://www.openwall.com/lists/oss-security/2016/03/25/8
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
ADP enrichment
No English description supplied.
- http://x-stream.github.io/changes.html#1.4.9
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html
- http://www.debian.org/security/2016/dsa-3575
- http://rhn.redhat.com/errata/RHSA-2016-2822.html
- http://www.securityfocus.com/bid/85381
- http://www.securitytracker.com/id/1036419
- http://www.openwall.com/lists/oss-security/2016/03/28/1
- http://rhn.redhat.com/errata/RHSA-2016-2823.html
- https://github.com/x-stream/xstream/issues/25
- http://www.openwall.com/lists/oss-security/2016/03/25/8
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html
No English description supplied.
No references supplied.