Home > Vulnerability Database > CVE-2021-3517

Mend.io Vulnerability Database

CVE-2021-3517

Date: May 19, 2021

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Language: C

Severity Score

8.6

Related Resources (26)

Url: https://access.redhat.com/security/cve/CVE-2021-3517

Url: https://www.oracle.com/security-alerts/cpujan2022.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6

Url: https://security.gentoo.org/glsa/202107-05

Url: https://www.oracle.com/security-alerts/cpuapr2022.html

Url: https://www.oracle.com/security-alerts/cpuoct2021.html

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/

Url: https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/

Url: https://github.com/sparklemotion/nokogiri/issues/2233

Url: https://security.netapp.com/advisory/ntap-20211022-0004

Url: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3517.yml

Url: https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-3517

Url: https://security.netapp.com/advisory/ntap-20210625-0002/

Url: https://security.netapp.com/advisory/ntap-20210625-0002

Url: https://bugzilla.redhat.com/show_bug.cgi?id=1954232

Url: https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

Url: https://security.netapp.com/advisory/ntap-20211022-0004/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV

Url: https://github.com/sparklemotion/nokogiri

Url: https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html

Url: https://www.oracle.com/security-alerts/cpujul2022.html

Url: https://github.com/sparklemotion/nokogiri/issues/2274

Url: https://www.mend.io/vulnerability-database/CVE-2021-3517

Severity Score

8.6

Weakness Type (CWE)

Buffer Errors

CWE-119

Out-of-bounds Write

CWE-787

CVSS v3.1

Base Score:	8.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	HIGH

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2021-3517

Date: May 19, 2021

Language: C

Severity Score

Related Resources (26)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?