Published: 19/05/2021 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 8.6 | Impact Score: 4.7 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

There is a flaw in the xml entity encoding functionality of libxml2 in versions prior to 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xmlsoft libxml2
redhat jboss core services -
redhat enterprise linux 8.0
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 9.0
netapp snapmanager -
netapp oncommand workflow automation -
netapp oncommand insight -
netapp ontap select deploy administration utility -
netapp clustered data ontap -
netapp e-series santricity storage manager -
netapp clustered data ontap antivirus connector -
netapp snapdrive -
netapp solidfire -
netapp hci management node -
netapp active iq unified manager -
netapp santricity unified manager -
netapp manageability software development kit -
netapp e-series santricity web services -
netapp e-series santricity os controller
netapp hci_h410c_firmware -
oracle peoplesoft enterprise peopletools 8.58
oracle enterprise manager base platform 13.4.0.0
oracle zfs storage appliance kit 8.8
oracle openjdk 8
oracle enterprise manager base platform 13.5.0.0
oracle mysql workbench
oracle real user experience insight 13.4.1.0
oracle real user experience insight 13.5.1.0
oracle communications cloud native core network function cloud native environment 1.10.0

Debian Bug report logs - #987738 libxml2: CVE-2021-3517 Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 28 Apr 2021 19:30:02 UTC Severity: important Tags: security, upstream Foun ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2437 SP11 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Updated packages that provide Red Hat JBoss Core Services Apache HTTP Server 2 ...

Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2437 SP11 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services Apache HTTP Server 2437 Service Pack 11 zip release for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft Windows is availableRed Hat Product Securit ...

Synopsis Moderate: OpenShift Container Platform 4103 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4103 is now available withupdates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security impact of ...

Synopsis Important: Service Telemetry Framework 14 security update Type/Severity Security Advisory: Important Topic An update is now available for Service Telemetry Framework 14 for RHEL 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which g ...

parserc in libxml2 before 295 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name (CVE-2017-16931) GNOME project libxml2 v2910 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entitiesc The issue has been ...

There is a flaw in the xml entity encoding functionality of libxml2 An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read The most likely impact of this flaw is to application availability, with some potential impact to confidentiali ...

GNOME project libxml2 v2910 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entitiesc The issue has been fixed in commit 50f06b3e (CVE-2020-24977) There is a flaw in the xml entity encoding functionality of libxml2 An attacker who is able to supply a crafted file to be processed by an application linked wit ...

No description is available for this CVE ...

A heap-based buffer overflow was found in libxml2 when processing truncated UTF-8 input ...

Critical Infrastructure Sectors: Energy

Critical Infrastructure Sectors: Critical Manufacturing

CWE-787 https://bugzilla.redhat.com/show_bug.cgi?id=1954232 https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html https://security.netapp.com/advisory/ntap-20210625-0002/https://security.gentoo.org/glsa/202107-05 https://www.oracle.com/security-alerts/cpuoct2021.html https://security.netapp.com/advisory/ntap-20211022-0004/https://www.oracle.com/security-alerts/cpujan2022.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987738 https://nvd.nist.gov https://www.cisa.gov/uscert/ics/advisories/icsa-21-336-08 https://alas.aws.amazon.com/ALAS-2023-1743.html

CVE-2021-3517

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect