CVE-2021-3537

Description

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

CVSS breakdown

Affected products

• Debian / debian_linux9.0 – 9.0
• fedoraproject / fedora34 – 34
• fedoraproject / fedora33 – 33
• NetApp / active_iq_unified_manager
• NetApp / Clustered Data ONTAP
• NetApp / clustered_data_ontap_antivirus_connector
• NetApp / hci_h410c_firmware
• NetApp / manageability_software_development_kit
• NetApp / ONTAP Select Deploy administration utility
• NetApp / snapdrive
• oracle / communications_cloud_native_core_network_function_cloud_native_environment1.10.0 – 1.10.0
• oracle / enterprise_manager_base_platform13.4.0.0 – 13.4.0.0
• oracle / enterprise_manager_base_platform13.5.0.0 – 13.5.0.0
• oracle / enterprise_manager_ops_center12.4.0.0 – 12.4.0.0
• oracle / mysql_workbench8.0.26
• oracle / openjdk8 – 8
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• oracle / real_user_experience_insight13.5.1.0 – 13.5.1.0
• oracle / real_user_experience_insight13.4.1.0 – 13.4.1.0
• RedHat / enterprise_linux7.0 – 7.0
• RedHat / enterprise_linux6.0 – 6.0
• RedHat / enterprise_linux8.0 – 8.0
• RedHat / jboss_core_services
• xmlsoft / libxml22.9.11

References

• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
• MISChttps://bugzilla.redhat.com/show_bug.cgi?id=1956522
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• MISChttps://security.gentoo.org/glsa/202107-05
• MISChttps://security.netapp.com/advisory/ntap-20210625-0002/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html