CVE:CVE-2016-3674
CNNVD:CNNVD-201603-404
XStream是XStream团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。
xstream 1.4.9之前版本的多个驱动程序（Dom4JDriver，DomDriver，JDomDriver，JDom2Driver，SjsxpDriver，StandardStaxDriver，WstxDriver）中存在信息泄露漏洞。远程攻击者可借助特制的XML文档利用该漏洞读取任意文件
solution:Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade fedoraproject fedora to a higher version than 22,23,and avoid the version 22,23; Upgrade xstream_project xstream to a higher version than 1.4.8,and avoid the version (,1.4.8]