A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

🗓️ 20 May 2021 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 1 Views

Libxml2 before 2.9.11 fails to propagate errors in recovery mode, causing crash.

Reporter	Title	Published	Views	Family All 212
IBM Security Bulletins	Security Bulletin: IBM RackSwitch firmware products are affected by vulnerabilities in Libxml2	7 Dec 202323:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System switch firmware products are affected by vulnerabilities in Libxml2	7 Dec 202323:00	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities fixed in Cloud Pak for Automation components	19 Jan 202216:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libxml2 may affect IBM Storage Archive	26 Aug 202522:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Verify Access	7 Jan 202200:24	–	ibm
ATTACKERKB	CVE-2021-3537	14 May 202120:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : libxml2 (ALAS-2021-1677)	1 Jul 202100:00	–	nessus
Tenable Nessus	Amazon Linux AMI : libxml2 (ALAS-2023-1743)	4 May 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0047: libxml2 (ALINUX3-SA-2021:0047)	14 May 202500:00	–	nessus

Vulners

Node

microsoft cm1_libxml2_2.9.12-1Range<2.9.12-1

20 May 2021 07:00Current

7High risk

Vulners AI Score7

CVSS 24.3

CVSS 3.15.9

EPSS0.03503

libxml2 version 2.9.11 recovery mode null dereference crash