CVE-2021-3517High· 8.6▾ TwilightThere is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could tri…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 3.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
17%
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
libxml2 < 2.9.11jboss_core_servicesenterprise_linux = 8.0fedora = 33fedora = 34debian_linux = 9.0active_iq_unified_managerclustered_data_ontapclustered_data_ontap_antivirus_connectore-series_santricity_os_controller >= 11.0.0, <= 11.70.1e-series_santricity_storage_managere-series_santricity_web_serviceshci_management_nodemanageability_software_development_kitoncommand_insightoncommand_workflow_automationontap_select_deploy_administration_utilitysantricity_unified_managersnapdrivesnapmanagersolidfirehci_h410c_firmwarecommunications_cloud_native_core_network_function_cloud_native_environment = 1.10.0enterprise_manager_base_platform = 13.4.0.0enterprise_manager_base_platform = 13.5.0.0mysql_workbench <= 8.0.26openjdk = 8peoplesoft_enterprise_peopletools = 8.58real_user_experience_insight = 13.4.1.0real_user_experience_insight = 13.5.1.0zfs_storage_appliance_kit = 8.8Upgrade past the affected range:
libxml2 2.9.11Connected by shared product, vendor, weakness, or advisory.
CVE-2017-9049High· 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c
CVE-2020-24977Medium· 6.5GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c
CVE-2017-9050High· 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c
CVE-2021-3541Medium· 6.5A flaw was found in libxml2
CVE-2021-3537Medium· 5.9A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference
CVE-2021-3518High· 8.8There's a flaw in libxml2 in versions before 2.9.11