CVE-2021-3517

Katalog CVE

CVSS 8.6 · High EPSS 17,0%

Kerentanan Out-of-bounds Write pada xmlsoft libxml2, redhat jboss core services +26 lainnya. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Rincian

Terbit di NVD

19 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write
CWE-125: Out-of-bounds Read

EPSS (30 hari)

17,0% peluang dieksploitasi; lebih tinggi dari 97,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1954232 issue tracking · patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-05 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210625-0002/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211022-0004/ advisory pihak ketiga
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.boo...
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.boo...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAO...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6Z...
• https://www.oracle.com/security-alerts/cpujul2022.html not applicable