High severity · published May 19, 2021
CVE-2021-3517
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11
8.6
CVSS
17%
EPSS
No
On KEV
Description
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)17.0% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libxml2 ·
libxml2 2.9.11 · source: vendor, NVD
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
CD
Clustered Data Ontap · Netapp
All versions, or not specified · source: NVD
CD
Clustered Data Ontap Antivirus Connector · Netapp
All versions, or not specified · source: NVD
CC
DL
Debian Linux · Debian
9.0 · source: NVD
ES
E-series Santricity OS Controller · Netapp
11.0.0 through 11.70.1 · source: NVD
ES
E-series Santricity Storage Manager · Netapp
All versions, or not specified · source: NVD
ES
E-series Santricity Web Services · Netapp
All versions, or not specified · source: NVD
EL
Enterprise Linux · Redhat
8.0 · source: NVD
EM
Enterprise Manager Base Platform · Oracle
13.4.0.0; 13.5.0.0 · source: NVD
FE
Fedora · Fedoraproject
33; 34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3517
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1954232
lists.apache.org
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
Mailing List
https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
More from libxml2
8.8
CVE-2021-3518
There's a flaw in libxml2 in versions before 2.9.11
7.8
CVE-2021-3516
There's a flaw in libxml2's xmllint in versions before 2.9.11
6.5
CVE-2021-3541
A flaw was found in libxml2
6.1
CVE-2016-3709
Possible cross-site scripting vulnerability in libxml after commit 960f0e2
5.9
CVE-2021-3537
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference