PT-2021-4600 · Libxml2+10 · Libxml2+10

Published 2021-04-22 · Updated 2026-03-13 · CVE-2021-3518

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.11

Description The issue is related to a use-after-free flaw in the xinclude.c component of the libxml2 library, which can be triggered by a specially crafted file. This can allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The flaw affects confidentiality, integrity, and availability.

Recommendations For versions prior to 2.9.11, update to version 2.9.11 or later to resolve the issue. As a temporary workaround, consider restricting the processing of crafted files by applications linked with libxml2 until a patch is available.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2021:2569

ALSA-2025_16880

ALT-PU-2021-2057

ALT-PU-2021-2997

ALT-PU-2021-3332

ALT-PU-2023-4266

ALT-PU-2024-7812

BDU:2021-05283

CESA-2021_2569

CVE-2021-3518

DLA-2653-1

GHSA-V4F8-2847-RWM7

MGASA-2021-0213

OESA-2021-1202

OPENSUSE-SU-2021:0692-1

OPENSUSE-SU-2021:0764-1

OPENSUSE-SU-2021_0692-1

OPENSUSE-SU-2021_0764-1

OPENSUSE-SU-2024:11016-1

OPENSUSE-SU-2024:11340-1

OPENSUSE-SU-2024:11912-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2026:10356-1

RHSA-2021:2569

RHSA-2021_2569

RHSA-2022:1389

RLSA-2021:2569

SUSE-SU-2021:14729-1

SUSE-SU-2021:1523-1

SUSE-SU-2021:1524-1

SUSE-SU-2021:1654-1

SUSE-SU-2021:1658-1

SUSE-SU-2021_14729-1

USN-4991-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Apple Macos

Red Hat

Rocky Linux

Suse

Ubuntu

Libxml2

References · 174

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3518.yml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-3518 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/685436 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-3518 · Security Note
• https://osv.dev/vulnerability/RLSA-2021:2569 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3537 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0692-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-2569.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3518 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11912-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3518 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24977 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4991-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1523-1 · Vendor Advisory