Log in Start free

Vulnerability · Published Jun 1, 2021 · Assigned by redhat

CVE-2021-3516

High 7.8

In plain English

A high-severity use-after-free in libxml2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)2.0%top 18.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libxml2-devel2.9.7-9.el8_4.2ALSA-2021:2569
Debian:12libxml22.9.10+dfsg-6.6DEBIAN-CVE-2021-3516
Debian:13libxml22.9.10+dfsg-6.6DEBIAN-CVE-2021-3516
Debian:14libxml22.9.10+dfsg-6.6DEBIAN-CVE-2021-3516
Rocky Linux:8libxml20:2.9.7-9.el8_4.2RLSA-2021:2569

Affected products (as reported)

VendorProductVersions
n/a libxml2 libxml2 2.9.11

Weakness: CWE-416

References