What’s Vulnerable › Vulnerabilities
CVE-2021-3516
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-06-01 · updated 2026-10-14
- Weakness: CWE-416
Description
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
Affected products
- Debian Linux: 9.0
- Fedoraproject Fedora: 33, 34
- Clustered Data ONTAP: all versions
- NetApp Clustered Data Ontap Antivirus Connector: all versions
- NetApp ONTAP Select Deploy administration utility: all versions
- Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
- Red Hat Enterprise Linux: 6.0, 7.0, 8.0
- RedHat Jboss Core Services: all versions
- xmlsoft Xmllint: before 2.9.11 — fixed in 2.9.11
How to fix
Upgrade to a fixed version: xmlsoft Xmllint 2.9.11. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1954225
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
- https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
- https://security.gentoo.org/glsa/202107-05
- https://security.netapp.com/advisory/ntap-20210716-0005/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1954225
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
Get alerted when CVE-2021-3516 or the next vulnerability affects your stack