PT-2022-11605 · Libxml2+3 · Libxml2+3

Published 2020-03-25 · Updated 2023-05-11 · CVE-2021-42521

Positive Technologies · (AI Summary)

CVSS v4.0

8.7

High

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions VTK versions prior to 9.2.5

Description The issue is a NULL pointer dereference vulnerability that lies in IO/Infovis/vtkXMLTreeReader.cxx. It occurs because the vendor did not check the return value of the libxml2 API xmlDocGetRootElement and attempted to dereference it. This is unsafe as the return value can be NULL, potentially causing the application to crash.

Recommendations For versions prior to 9.2.5, update to version 9.2.5 or later to resolve the issue. As a temporary workaround, consider adding checks for the return value of the xmlDocGetRootElement function to prevent NULL pointer dereferences.

Exploit

Fix

NULL Pointer Dereference

Resource Exhaustion

Weakness Enumeration

CWE-476

CWE-400

Related Identifiers

BDU:2025-03971

CVE-2021-42521

GHSA-XFHG-9PJG-XG7G

PYSEC-2022-255

Affected Products

Astra Linux

Debian

Vtk

Libxml2

References · 32

• 🔥 https://gitlab.kitware.com/vtk/vtk/issues/17818 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-42521 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-42521 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/vtk9 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=158612043 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/vtk6 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-42521 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/vtk7 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42521 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PCTMSAAVP4BW2HTZLDWMGKZ2WEC5OFLK · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42521 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42521 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCTMSAAVP4BW2HTZLDWMGKZ2WEC5OFLK · Vendor Advisory