CVE-2021-3518: Use After Free

Q: What is CVE-2021-3518?

CVE-2021-3518 is a vulnerability in libxml2 before version 2.9.11 that allows an attacker to trigger a use-after-free by submitting a crafted file to an application linked with libxml2.

Q: What is the impact of CVE-2021-3518?

The greatest impact of CVE-2021-3518 is to the confidentiality, integrity, and availability of the affected system.

Q: Which software versions are affected by CVE-2021-3518?

CVE-2021-3518 affects Apple watchOS up to version 7.6, Apple tvOS up to version 14.7, Apple macOS Big Sur up to version 11.5, and various packages from Red Hat.

Q: How can I fix CVE-2021-3518?

To fix CVE-2021-3518, update to libxml2 version 2.9.11 or later for Apple products, and apply the relevant patches or updates for Red Hat packages.

Q: Where can I find more information about CVE-2021-3518?

You can find more information about CVE-2021-3518 on the Apple support website at the provided reference links.

Published Apr 22, 2021

Updated

ActionKit. An input validation issue was addressed with improved input validation.

Other sources

AMD Kernel. A memory corruption issue was addressed with improved input validation.

— Apple

An use-after-free was found in libxml2 in xmlXIncludeDoProcess() in xinclude.c when processing crafted files.

Reference: https://gitlab.gnome.org/GNOME/libxml2/-/issues/237

Upstream patch: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7

— Red Hat

Analytics. A logic issue was addressed with improved restrictions.

— Apple

Analytics. This issue was addressed with a new entitlement.

— Apple

App Store. A permissions issue was addressed with improved validation.

— Apple

Credit

CVE-2021-3518, George Nosenko, JunDong Xie(Ant Security Light), ryuzaki, Mickey Jin@@patch1t(Trend Micro), Sunglin(Knownsec 404 team), Yizhuo Wang(Group of Software Security In Progress), Tim Michaud@@TimGMichaud(Zoom Video Communications), Linus Henze (pinauten.de), Csaba Fitzl@@theevilbit(Offensive Security), tr3e(Trend Micro Zero Day Initiative), hjy79425575(Trend Micro Zero Day Initiative), Matthew Denton(Google Chrome Security), Jzhu(Baidu Security), Ye Zhang@@co0py_Cat(Baidu Security), CFF(Topsec Alpha Team), CVE-2018-25010, CVE-2018-25011, CVE-2018-25014, CVE-2020-36328, CVE-2020-36329, CVE-2020-36330, CVE-2020-36331, Anonymous(Trend Micro Zero Day Initiative), Christoph Guttandin(Media Codings), Sergei Glazunov(Google Project Zero), Ivan Fratric(Google Project Zero), vm_call, Nozhdar Abdulkhaleq Shukri, Zachary Keffaber@@QuickUpdate5, Denis Tokarev@@illusionofcha0s, tr3e, Mickey Jin@@patch1t(Trend Micro working with Trend Micro Zero Day Initiative), Georgi Valkov (httpstorm.com), Zhongcheng Li (CK01), Ron Waisberg@@epsilan, Gary Nield(ECSC Group plc), Wojciech Reguła@@_r3ggi(SecuRing), Matt Shockley (twitter.com/mattshockl)(Offensive Security), Liu Long(Ant Security Light), Yinyi Wu@@3ndy1(Qihoo 360 Vulcan Team), Zuozhi Fan@@pattern_F_(Ant Security TianQiong Lab), ABC Research s.r.o

Affected Software

45 affected componentsFixes available

rubygems/nokogiri<1.11.4

1.11.4

redhat/jbcs-httpd24-apr-util<0:1.6.1-91.el8

0:1.6.1-91.el8

redhat/jbcs-httpd24-curl<0:7.78.0-3.el8

0:7.78.0-3.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-80.el8

0:2.4.37-80.el8

redhat/jbcs-httpd24-nghttp2<0:1.39.2-41.el8

0:1.39.2-41.el8

redhat/jbcs-httpd24-openssl<1:1.1.1g-11.el8

1:1.1.1g-11.el8

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-11.el8

0:1.0.0-11.el8

redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-26.el8

0:0.4.10-26.el8

redhat/jbcs-httpd24-apr-util<0:1.6.1-91.jbcs.el7

0:1.6.1-91.jbcs.el7

redhat/jbcs-httpd24-curl<0:7.78.0-3.jbcs.el7

0:7.78.0-3.jbcs.el7

redhat/jbcs-httpd24-httpd<0:2.4.37-80.jbcs.el7

0:2.4.37-80.jbcs.el7

redhat/jbcs-httpd24-nghttp2<0:1.39.2-41.jbcs.el7

0:1.39.2-41.jbcs.el7

redhat/jbcs-httpd24-openssl<1:1.1.1g-11.jbcs.el7

1:1.1.1g-11.jbcs.el7

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-11.jbcs.el7

0:1.0.0-11.jbcs.el7

redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-26.jbcs.el7

0:0.4.10-26.jbcs.el7

redhat/libxml2<0:2.9.7-9.el8_4.2

0:2.9.7-9.el8_4.2

redhat/libxml2<2.9.11

2.9.11

Apple macOS Big Sur<11.5

11.5

Apple tvOS<14.7

14.7

Apple WatchOS<7.6

7.6

IBM Security Verify Access<=10.0.0

Xmlsoft Libxml2<2.9.11

Debian Debian Linux=9.0

redhat JBoss Core Services

redhat Enterprise Linux=8.0

Fedoraproject Fedora=33

Fedoraproject Fedora=34

NetApp Active Iq Unified Manager Vmware Vsphere

NetApp Clustered Data ONTAP

NetApp Clustered Data Ontap Antivirus Connector

NetApp Manageability Software Development Kit

NetApp ONTAP Select Deploy administration utility

NetApp Snapdrive Windows

NetApp Hci H410c Firmware

NetApp Hci H410c

Oracle Communications Cloud Native Core Network Function Cloud Native Environment=1.10.0

Oracle Enterprise Manager Base Platform=13.4.0.0

Oracle Enterprise Manager Base Platform=13.5.0.0

Oracle Enterprise Manager Ops Center=12.4.0.0

Oracle MySQL Workbench<=8.0.26

Oracle PeopleSoft Enterprise PeopleTools=8.58

Oracle Real User Experience Insight=13.4.1.0

Oracle Real User Experience Insight=13.5.1.0

Apple iOS<14.7

14.7

Apple iPadOS<14.7

14.7

Remediation

Event History

Apr 22, 2021

CVE Published

12:00 AM

Apr 27, 2021

Data Sourced

via Red Hat·07:03 PM

DescriptionSeverityAffected Software

May 18, 2021

CVE Published

via MITRE·11:20 AM

Data Sourced

via MITRE·11:20 AM

DescriptionWeakness

Jul 19, 2021

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Affected Software

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Jul 21, 2021

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

Affected Software

May 24, 2022

Advisory Published

07:02 PM

Feb 24, 2026

Updated

via Apple·07:00 PM

DescriptionWeaknessAffected Software

Updated

via Apple·07:00 PM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2021-3518?

CVE-2021-3518 is a vulnerability in libxml2 before version 2.9.11 that allows an attacker to trigger a use-after-free by submitting a crafted file to an application linked with libxml2.

What is the impact of CVE-2021-3518?

The greatest impact of CVE-2021-3518 is to the confidentiality, integrity, and availability of the affected system.

Which software versions are affected by CVE-2021-3518?

CVE-2021-3518 affects Apple watchOS up to version 7.6, Apple tvOS up to version 14.7, Apple macOS Big Sur up to version 11.5, and various packages from Red Hat.

How can I fix CVE-2021-3518?

To fix CVE-2021-3518, update to libxml2 version 2.9.11 or later for Apple products, and apply the relevant patches or updates for Red Hat packages.

Where can I find more information about CVE-2021-3518?

You can find more information about CVE-2021-3518 on the Apple support website at the provided reference links.

CVE-2021-3518: Use After Free

Other sources

Credit

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2021-3518?

What is the impact of CVE-2021-3518?

Which software versions are affected by CVE-2021-3518?

How can I fix CVE-2021-3518?

Where can I find more information about CVE-2021-3518?

Company

Resources

Contact