CVEvulnerability

CVE-2021-3517

8.6 HIGH Published 2021-05-19 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2021-05-19
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-125, CWE-787

Description

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Affected configurations

• xmlsoft libxml2 (< 2.9.11) • redhat jboss core services • redhat enterprise linux 8.0 • fedoraproject fedora 33 • fedoraproject fedora 34 • debian debian linux 9.0 • netapp active iq unified manager • netapp clustered data ontap • netapp clustered data ontap antivirus connector • netapp e-series santricity os controller (>= 11.0.0 <= 11.70.1) • netapp e-series santricity storage manager • netapp e-series santricity web services • netapp hci management node • netapp manageability software development kit • netapp oncommand insight • netapp oncommand workflow automation • netapp ontap select deploy administration utility • netapp santricity unified manager • netapp snapdrive • netapp snapmanager • netapp solidfire • netapp hci h410c firmware • oracle communications cloud native core network function cloud native environment 1.10.0 • oracle enterprise manager base platform 13.4.0.0 • oracle enterprise manager base platform 13.5.0.0 • oracle mysql workbench (<= 8.0.26) • oracle openjdk 8 • oracle peoplesoft enterprise peopletools 8.58 • oracle real user experience insight 13.4.1.0 • oracle real user experience insight 13.5.1.0 • oracle zfs storage appliance kit 8.8

Related

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-787 Out-of-bounds Write weakness

References