CVE-2021-3537
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
- CVSS 3.1
- 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-25)
- CWE
- CWE-476
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- netapp:active_iq_unified_manager
- netapp:clustered_data_ontap
- netapp:clustered_data_ontap_antivirus_connector
- netapp:hci_h410c_firmware
- netapp:manageability_software_development_kit
- netapp:ontap_select_deploy_administration_utility
- netapp:snapdrive
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:enterprise_manager_base_platform
- oracle:enterprise_manager_ops_center
- oracle:mysql_workbench
- oracle:openjdk
- oracle:peoplesoft_enterprise_peopletools
- oracle:real_user_experience_insight
- redhat:enterprise_linux
- redhat:jboss_core_services
- xmlsoft:libxml2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-286v-pcf5-25rc | RubyGems | nokogiri | <1.11.4 | 1.11.4 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1956522
- https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
- https://security.gentoo.org/glsa/202107-05