There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libxml2-devel | May 4, 2022 | May 19, 2021 |
| Alpine Linux | — | Upgrade qt5-qtwebengineUpgrade libxml2 | Mar 26, 2024 | May 19, 2021 |
| Amazon Linux Ami 2 | — | Upgrade libxml2Upgrade libxml2-debuginfoUpgrade libxml2-develUpgrade java-11-amazon-correttoUpgrade java-11-amazon-corretto-javadocUpgrade libxml2-staticUpgrade java-1.8.0-amazon-corretto-develUpgrade java-1.8.0-amazon-correttoUpgrade java-11-amazon-corretto-headlessUpgrade libxml2-python | Jun 24, 2021 | May 19, 2021 |
| Amazon_linux | — | Upgrade libxml2 | May 4, 2023 | May 5, 2021 |
| Azul Zulu | — | Apply Azul Zulu JDK 15 installer 15.35 (JDK 15.0.4.0.101+1, quarterly CPU) (short-term support); migrate to JDK 17 (LTS)Upgrade to Azul Zulu JDK 11 installer 11.51 (JDK 11.0.12.0.101+2, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.57 (JDK 8u311-b02, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.30 (JDK 17.0.1+12, PSU) (LTS stream)Apply Azul Zulu JDK 13 installer 13.43 (JDK 13.0.8.0.101+1, quarterly CPU) (short-term support); migrate to JDK 17 (LTS) | Nov 30, 2021 | May 19, 2021 |
| Centos_linux | — | Upgrade python3-libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2Upgrade libxml2-develUpgrade libxml2-debugsourceUpgrade libxml2-debuginfo | Jun 30, 2021 | May 19, 2021 |
| Debian | — | Upgrade libxml2 | May 12, 2021 | May 12, 2021 |
| Gentoo Linux | — | Upgrade dev-libs/libxml2. | Jul 8, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libxml2-develUpgrade libxml2Upgrade libxml2-python | Sep 16, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libxml2-pythonUpgrade libxml2Upgrade libxml2-devel | Oct 26, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libxml2Upgrade libxml2-pythonUpgrade libxml2-devel | Sep 7, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libxml2Upgrade python3-libxml2Upgrade libxml2-develUpgrade libxml2 | Aug 10, 2021 | May 19, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-libxml2Upgrade libxml2 | Aug 10, 2021 | May 19, 2021 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 20, 2021 | May 19, 2021 |
| Oracle Solaris | — | Upgrade library/python/libxml2-39 to version 2.9.12-11.4.39.0.1.107.0 on Solaris 11.4Upgrade library/python/libxml2-37 to version 2.9.12-11.4.39.0.1.107.0 on Solaris 11.4Upgrade library/python/libxml2-27 to version 2.9.12-11.4.39.0.1.107.0 on Solaris 11.4Upgrade library/libxslt to version 1.1.33-11.4.39.0.1.107.0 on Solaris 11.4Upgrade library/libxml2 to version 2.9.12-11.4.39.0.1.107.0 on Solaris 11.4 | Nov 17, 2021 | May 19, 2021 |
| Oracle_linux | — | Upgrade python3-libxml2Upgrade libxml2-develUpgrade libxml2 | Jul 3, 2021 | Apr 22, 2021 |
| Redhat_linux | — | Upgrade python3-libxml2-debuginfoUpgrade libxml2No solution existsUpgrade libxml2-develUpgrade libxml2-debugsourceUpgrade libxml2-debuginfoUpgrade python3-libxml2 | Jun 30, 2021 | May 19, 2021 |
| Rocky_linux | — | Upgrade libxml2-develUpgrade libxml2-debugsourceUpgrade libxml2-debuginfoUpgrade libxml2Upgrade python3-libxml2Upgrade python3-libxml2-debuginfo | May 5, 2022 | May 19, 2021 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.13Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.2.10 | Sep 30, 2025 | May 19, 2021 |
| Suse | — | Upgrade libqt5-qtwebengineUpgrade libxml2-pythonUpgrade libxml2-toolsUpgrade libxml2-develUpgrade libxml2-2Upgrade python3-libxml2-pythonUpgrade libxml2-2-32bitUpgrade python3-libxml2Upgrade python-libxml2Upgrade libxml2-32bitUpgrade libxml2-devel-32bitUpgrade libxml2-docUpgrade libxml2Upgrade python2-libxml2-python | May 6, 2021 | May 5, 2021 |
| Ubuntu | — | Upgrade libxml2 (Ubuntu Pro)Upgrade libxml2Upgrade libxml2-utils (Ubuntu Pro)Upgrade libxml2-utils | Jun 18, 2021 | May 5, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub