CVE-2021-3517

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Nokogiri prior to version 1.11.4 used a vulnerable version of libxml2. Nokogiri 1.11.4 updated libxml2 to version 2.9.11 to address this and other vulnerabilities in libxml2.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.(CVE-2021-3537)

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.(CVE-2021-3518)

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.(CVE-2021-3517)

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516)

• libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517)

• libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518)

• libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode (CVE-2021-3537)

• libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms (CVE-2021-3541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516)

• libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517)

• libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518)

• libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode (CVE-2021-3537)

• libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms (CVE-2021-3541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities
• CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'
• CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv
• CVE-2021-3541.patch: parser fix for the billion laughs attack
• CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'
• CVE-2017-8872.patch: free input buffer in xmlHaltParser
• CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream
• CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'

• SECURITY UPDATE: Out-of-bounds array access
  • debian/patches/CVE-2021-3517.patch: Validate UTF8 in xmlEncodeEntities
  • CVE-2021-3517
• SECURITY UPDATE: Use-after-free error
  • debian/patches/CVE-2021-3518.patch: Fix use-after-free with 'xmllint --xinclude --dropdtd'
  • CVE-2021-3518
• SECURITY UPDATE: Null pointer dereference while parsing in recovery mode
  • debian/patches/CVE-2021-3537.patch: Propagate error in xmlParseElementChildrenContentDeclPriv
  • CVE-2021-3537
• SECURITY UPDATE: Parser fix for the billion laugs attach
  • debian/patches/CVE-2021-3541.patch: Fix parameter entities expansion in xmlParserEntityCheck
  • CVE-2021-3541
• SECURITY UPDATE: Miscalculation of available bytes when parsing
  • debian/patches/CVE-2017-8872.patch: Free input buffer in xmlHaltParser
  • CVE-2017-8872
• SECURITY UPDATE: Memory leak
  • debian/patches/CVE-2019-20388.patch: Fix memory leak in xmlSchemaValidateStream
  • CVE-2019-20388
• SECURITY UPDATE: Out-of-bounds array access
  • debian/patches/CVE-2020-24977.patch: Fix out-of-bounds read with 'xmllint --htmlout'
  • CVE-2020-24977
• SECURITY UPDATE: Use-after-free error
  • debian/patches/CVE-2021-3516.patch: Fix use-after-free with 'xmllint --html --push'
  • CVE-2021-3516

• CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities
• CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'
• CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv
• CVE-2021-3541.patch: parser fix for the billion laughs attack
• CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'
• CVE-2017-8872.patch: free input buffer in xmlHaltParser
• CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream
• CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'

• CVE-2021-3517: fix flaw in the xml entity encoding
• CVE-2021-3518: fix dangling pointers in entity reference nodes
• CVE-2022-23308: fix use-after-free of ID and IDREF attributes
• CVE-2022-40303: fix integer counters overflow when parsing a multi-gigabyte XML
• CVE-2022-40304: fix double free as a result of an invalid XML entity
• fix testapi.c to avoid false positive test errors
• fix a parser and fix a null pointer dereference

The updated packages fix security vulnerabilities:

Use-after-free in xmlEncodeEntitiesInternal() in entities.c. (CVE-2021-3516)

Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c. (CVE-2021-3517)

Use-after-free in xmlXIncludeDoProcess() in xinclude.c. (CVE-2021-3518)

NULL pointer dereference in valid.c in xmlValidBuildAContentModel. (CVE-2021-3537)

The qtwebengine5 package has been updated to version 5.15.8, fixing several security issues in the bundled chromium code. See the referenced package announcement for details.

This update for libxml2 fixes the following issues:

• CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
• CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
• CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libxml2 fixes the following issues:

• CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel (bsc#1185698)
• CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
• CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
• CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libxml2-2-2.9.12-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby2.7-rubygem-nokogiri-1.12.3-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libQt5Pdf5-5.15.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

This update for libxml2 fixes the following issues:

Security issues fixed:

• CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel (bsc#1185698)
• CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
• CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
• CVE-2021-3516: Fixed a use after free in xmlEncodeEntitiesInternal() in entities.c (bsc#1185409)
• CVE-2020-24977: Fixed a global-buffer-overflow in xmlEncodeEntitiesInternal (bsc#1176179).
• CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun (bsc#1161521).
• CVE-2020-7595: Fixed an infinite loop in an EOF situation (bsc#1161517).
• CVE-2019-19956: Fixed a memory leak in xmlParseBalancedChunkMemoryRecover (bsc#1159928).

This update for libxml2 fixes the following issues:

• CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
• CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
• CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409).

This update for libxml2 fixes the following issues:

• CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
• CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
• CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409).

This update for libxml2 fixes the following issues:

• CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel (bsc#1185698)
• CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
• CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
• CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409).

This update for libxml2 fixes the following issues:

Security issues fixed:

CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel (bsc#1185698)

• CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
• CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
• CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409).

Yunho Kim discovered that libxml2 incorrectly handled certain error conditions. A remote attacker could exploit this with a crafted XML file to cause a denial of service, or possibly cause libxml2 to expose sensitive information. This issue only affected Ubuntu 14.04 ESM, and Ubuntu 16.04 ESM. (CVE-2017-8872)

Zhipeng Xie discovered that libxml2 incorrectly handled certain XML schemas. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS. (CVE-2019-20388)

It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A remote attacker could possibly exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-24977)

It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A remote attacker could possibly exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. (CVE-2021-3517)

It was discovered that libxml2 did not properly handle certain crafted XML files. A local attacker could exploit this with a crafted input to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3516, CVE-2021-3518)

It was discovered that libxml2 incorrectly handled error states. A remote attacker could exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. (CVE-2021-3537)

Sebastian Pipping discovered that libxml2 did not properly handle certain crafted XML files. A remote attacker could exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3541)