Vulmon
Amazon Linux 2 Security Advisory: ALAS-2021-1677
Advisory Release Date: 2021-07-01 01:03 Pacific
Advisory Updated Date: 2021-07-01 20:27 Pacific
There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability. (CVE-2021-3516)
There's a flaw in libxml2. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability. (CVE-2021-3537)
Affected Packages:
libxml2
Issue Correction:
Run yum update libxml2 to update your system.
aarch64:
libxml2-2.9.1-6.amzn2.5.4.aarch64
libxml2-devel-2.9.1-6.amzn2.5.4.aarch64
libxml2-static-2.9.1-6.amzn2.5.4.aarch64
libxml2-python-2.9.1-6.amzn2.5.4.aarch64
libxml2-debuginfo-2.9.1-6.amzn2.5.4.aarch64
i686:
libxml2-2.9.1-6.amzn2.5.4.i686
libxml2-devel-2.9.1-6.amzn2.5.4.i686
libxml2-static-2.9.1-6.amzn2.5.4.i686
libxml2-python-2.9.1-6.amzn2.5.4.i686
libxml2-debuginfo-2.9.1-6.amzn2.5.4.i686
src:
libxml2-2.9.1-6.amzn2.5.4.src
x86_64:
libxml2-2.9.1-6.amzn2.5.4.x86_64
libxml2-devel-2.9.1-6.amzn2.5.4.x86_64
libxml2-static-2.9.1-6.amzn2.5.4.x86_64
libxml2-python-2.9.1-6.amzn2.5.4.x86_64
libxml2-debuginfo-2.9.1-6.amzn2.5.4.x86_64