CVE-2021-3516

Опубликовано: 01 июн. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1954225
Issue Tracking
Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
Exploit
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
https://security.gentoo.org/glsa/202107-05
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210716-0005/
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1954225
Issue Tracking
Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
Patch
Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
Exploit
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
https://security.gentoo.org/glsa/202107-05
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210716-0005/
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:xmlsoft:xmllint:*:*:*:*:*:*:*:*

Версия до 2.9.11 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Конфигурация 6

cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00362

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2021-3516

CVSS3: 7.8

ubuntu

около 4 лет назад

CVE-2021-3516

CVSS3: 7.8

redhat

больше 4 лет назад

CVE-2021-3516

CVSS3: 7.8

debian

около 4 лет назад

There's a flaw in libxml2's xmllint in versions before 2.9.11. An atta ...

GHSA-cfj9-6cq4-25vj

github

около 3 лет назад

BDU:2021-05282

CVSS3: 8.8

fstec

больше 4 лет назад

Уязвимость компонента xmllint библиотеки Libxml2, связанная с использованием памяти после её освобождения, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

EPSS

Процентиль: 58%

0.00362

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416