Log in Start free

Vulnerability · Published May 14, 2021 · Assigned by redhat

CVE-2021-3537

Medium 5.9

In plain English

A medium-severity null pointer dereference in libxml2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)3.6%top 10.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libxml2-devel2.9.7-9.el8_4.2ALSA-2021:2569
Alpine:v3.20libxml22.9.11-r0ALPINE-CVE-2021-3537
Alpine:v3.21libxml22.9.11-r0ALPINE-CVE-2021-3537
Alpine:v3.22libxml22.9.11-r0ALPINE-CVE-2021-3537
Alpine:v3.23libxml22.9.11-r0ALPINE-CVE-2021-3537
Alpine:v3.24libxml22.9.11-r0ALPINE-CVE-2021-3537
Debian:12libxml22.9.10+dfsg-6.6DEBIAN-CVE-2021-3537
Debian:13libxml22.9.10+dfsg-6.6DEBIAN-CVE-2021-3537
Debian:14libxml22.9.10+dfsg-6.6DEBIAN-CVE-2021-3537
Rocky Linux:8libxml20:2.9.7-9.el8_4.2RLSA-2021:2569
RubyGemsnokogiri1.11.4GHSA-286v-pcf5-25rc

Affected products (as reported)

VendorProductVersions
n/a libxml2 libxml2 2.9.11

Weakness: CWE-476

References