CVE-2016-3674: debian debian_linux
CVSS: 7.5v3.1HighAnalyzed
AliasesMGASA-2016-0164UBUNTU-CVE-2016-3674DEBIAN-CVE-2016-3674DLA-504-1DSA-3575-1GHSA-rgh3-987h-wpmw
Published 17-05-2016Last modified 08-10-2026
Vulnerability summary
CVE-2016-3674 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 8.18% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
8.18%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 17-05-2016PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
CVSS metrics
6 scores · 4 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
High 7.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
8.18%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.18% on 18-09-2026
18-09-202618-10-2026
EPSS score8.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- libxstream-java< 1.4.9-1 | < 1.4.2-1+deb7u1 | < 1.4.7-2+deb8u1
- debian_linuxEOL8.0
Mageia2 products
- javapackages-tools< 4.1.0-15.1.mga5
- xstream< 1.4.9-1.mga5
Com.thoughtworks.xstream1 product
- xstream< 1.4.9
Fedoraproject1 product
- fedoraEOL22 | 23
Redhat1 product
Ubuntu1 product
- libxstream-java< 1.4.7-1ubuntu0.1+esm2 | < 1.4.8-1ubuntu0.1+esm3
Xstream1 product
- xstream< 1.4.9
7 vendors · 9 products
References
21 links- lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.htmlVendor AdvisoryX Refsource FEDORABroken LinkThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2016/03/28/1Mailing ListX Refsource MLISTThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2016/03/25/8Mailing ListX Refsource MLISTThird Party AdvisoryWEB
Show all 21 references
- lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.htmlVendor AdvisoryX Refsource FEDORABroken LinkThird Party AdvisoryWEB
- github.com/x-stream/xstreamPACKAGE