8.6

CVE-2021-3517

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xmlsoft ≫ Libxml2 Version < 2.9.11
Redhat ≫ Enterprise Linux Version8.0
Fedoraproject ≫ Fedora Version33
Fedoraproject ≫ Fedora Version34
Debian ≫ Debian Linux Version9.0
Netapp ≫ Active Iq Unified Manager Version- SwPlatformvmware_vsphere
Netapp ≫ Active Iq Unified Manager Version- SwPlatformwindows
Netapp ≫ E-series Santricity Os Controller Version >= 11.0.0 <= 11.70.1
Netapp ≫ E-series Santricity Web Services Version- SwPlatformweb_services_proxy
Netapp ≫ Oncommand Insight Version-
Netapp ≫ Snapdrive Version- SwPlatformwindows
Netapp ≫ Snapmanager Version- SwPlatformoracle
Netapp ≫ Snapmanager Version- SwPlatformsap
Netapp ≫ Solidfire Version-
Netapp ≫ Hci H410c Firmware Version-
   Netapp ≫ Hci H410c Version-
Oracle ≫ Mysql Workbench Version <= 8.0.26
Oracle ≫ Openjdk Version8 Updateupdate301
Oracle ≫ Real User Experience Insight Version13.4.1.0
Oracle ≫ Real User Experience Insight Version13.5.1.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.09% 0.269
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.6 3.9 4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://bugzilla.redhat.com/show_bug.cgi?id=1954232
Patch
Third Party Advisory
Issue Tracking