PT-2021-4592 · Libxml2+11 · Libxml2+11
Published
2021-04-22
·
Updated
2026-03-13
·
CVE-2021-3517
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.9.11
Nokogiri versions prior to 1.11.4
Description
The issue is related to a flaw in the xml entity encoding functionality, which could trigger an out-of-bounds read if a crafted file is processed by an application linked with the affected functionality. This could impact application availability, with potential effects on confidentiality and integrity if an attacker uses memory information to further exploit the application.
Recommendations
For libxml2 versions prior to 2.9.11, update to version 2.9.11 or later to address the issue.
For Nokogiri versions prior to 1.11.4, update to version 1.11.4 or later, which includes an updated version of libxml2 that addresses this vulnerability.
Exploit
Fix
DoS
Out of bounds Read
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Java Platform
Linuxmint
Nokogiri
Red Hat
Rocky Linux
Suse
Ubuntu
Libxml2