CVE-2021-3516: Use After Free
An use-after-free was found in xmllint when used with --html and --push options when processing crafted files.
Reference: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
Upstream patch: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
Other sources
libxml2 could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in xmlEncodeEntitiesInternal() in entities.c. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw in libxml2's xmllint?
The vulnerability ID for this flaw in libxml2's xmllint is CVE-2021-3516.
What is the severity of CVE-2021-3516?
The severity of CVE-2021-3516 is high, with a severity value of 7.8.
How does CVE-2021-3516 impact the system?
CVE-2021-3516 allows a remote attacker to execute arbitrary code on the system.
What is the affected software for CVE-2021-3516?
The affected software for CVE-2021-3516 includes libxml2 version up to 2.9.11, jbcs-httpd24-apr-util version up to 0:1.6.1-91.el8, jbcs-httpd24-curl version up to 0:7.78.0-3.el8, jbcs-httpd24-httpd version up to 0:2.4.37-80.el8, jbcs-httpd24-nghttp2 version up to 0:1.39.2-41.el8, jbcs-httpd24-openssl version up to 1:1.1.1g-11.el8, jbcs-httpd24-openssl-chil version up to 0:1.0.0-11.el8, jbcs-httpd24-openssl-pkcs11 version up to 0:0.4.10-26.el8, jbcs-httpd24-apr-util version up to 0:1.6.1-91.jbcs.el7, jbcs-httpd24-curl version up to 0:7.78.0-3.jbcs.el7, jbcs-httpd24-httpd version up to 0:2.4.37-80.jbcs.el7, jbcs-httpd24-nghttp2 version up to 0:1.39.2-41.jbcs.el7, jbcs-httpd24-openssl version up to 1:1.1.1g-11.jbcs.el7, jbcs-httpd24-openssl-chil version up to 0:1.0.0-11.jbcs.el7, libxml2 version up to 0:2.9.7-9.el8_4.2, IBM Security Verify Access up to version 10.0.0, Xmlsoft Xmllint up to version 2.9.11, Debian Debian Linux version 9.0, Fedoraproject Fedora versions 33 and 34, Microsoft .NET 7.0, Redhat Enterprise Linux versions 6.0, 7.0, and 8.0, NetApp Clustered Data ONTAP, Netapp Clustered Data Ontap Antivirus Connector, NetApp ONTAP Select Deploy administration utility, and Oracle ZFS Storage Appliance Kit version 8.8.
How can I fix the vulnerability in libxml2's xmllint (CVE-2021-3516)?
To fix the vulnerability in libxml2's xmllint (CVE-2021-3516), it is recommended to update to version 2.9.11 or apply the appropriate patch provided by the software vendor.