CVE-2021-3518

Published: May 18, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Affected (21)

Products: Xmlsoft: Libxml2 · Debian: Debian Linux · Redhat: Enterprise Linux, Jboss Core Services · +3 more

Show all products

1 product

1 product

2 products

1 product

7 products

Active Iq Unified Manager

Clustered Data Ontap

Clustered Data Ontap Antivirus Connector

Manageability Software Development Kit

Ontap Select Deploy Administration Utility

Snapdrive

Hci H410c Firmware

Oracle

6 products

Communications Cloud Native Core Network Function Cloud Native Environment

Enterprise Manager Base Platform

Enterprise Manager Ops Center

Mysql Workbench

Peoplesoft Enterprise Peopletools

Real User Experience Insight

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Before 2.9.11

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Jboss Core Services	All versions

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Clustered Data Ontap	All versions
Netapp Clustered Data Ontap Antivirus Connector	All versions
Netapp Manageability Software Development Kit	All versions
Netapp Ontap Select Deploy Administration Utility	All versions
Netapp Snapdrive	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Hci H410c Firmware	All versions

Running on/with	Platform Versions
Netapp Hci H410c	All versions

Configuration G

8 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Network Function Cloud Native Environment	Version 1.10.0
Oracle Enterprise Manager Base Platform	Version 13.4.0.0
Oracle Enterprise Manager Base Platform	Version 13.5.0.0
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Mysql Workbench	Up to 8.0.26
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Real User Experience Insight	Version 13.4.1.0
Oracle Real User Experience Insight	Version 13.5.1.0

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (38)

http://seclists.org/fulldisclosure/2021/Jul/54

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2021/Jul/55

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2021/Jul/58

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2021/Jul/59

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1954242

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

Source: secalert@redhat.com

https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/

Source: secalert@redhat.com

https://security.gentoo.org/glsa/202107-05

Source: secalert@redhat.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210625-0002/

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/kb/HT212601

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/kb/HT212602

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/kb/HT212604

Source: secalert@redhat.com

Third Party Advisory

https://support.apple.com/kb/HT212605

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: secalert@redhat.com

Not Applicable

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://seclists.org/fulldisclosure/2021/Jul/54