CVE-2021-3517High· 8.6▾ TwilightThere is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could tri…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 3.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
17%
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
libxml2 < 2.9.11jboss_core_servicesenterprise_linux = 8.0fedora = 33fedora = 34debian_linux = 9.0active_iq_unified_managerclustered_data_ontapclustered_data_ontap_antivirus_connectore-series_santricity_os_controller >= 11.0.0, <= 11.70.1e-series_santricity_storage_managere-series_santricity_web_serviceshci_management_nodemanageability_software_development_kitoncommand_insightoncommand_workflow_automationontap_select_deploy_administration_utilitysantricity_unified_managersnapdrivesnapmanagersolidfirehci_h410c_firmwarecommunications_cloud_native_core_network_function_cloud_native_environment = 1.10.0enterprise_manager_base_platform = 13.4.0.0enterprise_manager_base_platform = 13.5.0.0mysql_workbench <= 8.0.26openjdk = 8peoplesoft_enterprise_peopletools = 8.58real_user_experience_insight = 13.4.1.0real_user_experience_insight = 13.5.1.0zfs_storage_appliance_kit = 8.8Upgrade past the affected range:
libxml2 2.9.11Connected by shared product, vendor, weakness, or advisory.
CVE-2020-24977Medium· 6.5GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c
CVE-2017-9050High· 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c
CVE-2017-9049High· 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c
CVE-2022-29824Medium· 6.5In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows
CVE-2022-23308High· 7.5valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2021-3541Medium· 6.5A flaw was found in libxml2