CVE-2021-3541

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

This library allows to manipulate XML files. It includes supportto read, modify and write XML and HTML files. There is DTDs supportthis includes parsing and validation even with complex DtDs, eitherat parse time or later once the document has been modified. The outputcan be a simple SAX stream or an(CVE-2021-3541)

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516)

• libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517)

• libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518)

• libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode (CVE-2021-3537)

• libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms (CVE-2021-3541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516)

• libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517)

• libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518)

• libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode (CVE-2021-3537)

• libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms (CVE-2021-3541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities
• CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'
• CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv
• CVE-2021-3541.patch: parser fix for the billion laughs attack
• CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'
• CVE-2017-8872.patch: free input buffer in xmlHaltParser
• CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream
• CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'

• SECURITY UPDATE: Out-of-bounds array access
  • debian/patches/CVE-2021-3517.patch: Validate UTF8 in xmlEncodeEntities
  • CVE-2021-3517
• SECURITY UPDATE: Use-after-free error
  • debian/patches/CVE-2021-3518.patch: Fix use-after-free with 'xmllint --xinclude --dropdtd'
  • CVE-2021-3518
• SECURITY UPDATE: Null pointer dereference while parsing in recovery mode
  • debian/patches/CVE-2021-3537.patch: Propagate error in xmlParseElementChildrenContentDeclPriv
  • CVE-2021-3537
• SECURITY UPDATE: Parser fix for the billion laugs attach
  • debian/patches/CVE-2021-3541.patch: Fix parameter entities expansion in xmlParserEntityCheck
  • CVE-2021-3541
• SECURITY UPDATE: Miscalculation of available bytes when parsing
  • debian/patches/CVE-2017-8872.patch: Free input buffer in xmlHaltParser
  • CVE-2017-8872
• SECURITY UPDATE: Memory leak
  • debian/patches/CVE-2019-20388.patch: Fix memory leak in xmlSchemaValidateStream
  • CVE-2019-20388
• SECURITY UPDATE: Out-of-bounds array access
  • debian/patches/CVE-2020-24977.patch: Fix out-of-bounds read with 'xmllint --htmlout'
  • CVE-2020-24977
• SECURITY UPDATE: Use-after-free error
  • debian/patches/CVE-2021-3516.patch: Fix use-after-free with 'xmllint --html --push'
  • CVE-2021-3516

• CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities
• CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'
• CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv
• CVE-2021-3541.patch: parser fix for the billion laughs attack
• CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'
• CVE-2017-8872.patch: free input buffer in xmlHaltParser
• CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream
• CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'

• SECURITY UPDATE: use-after-free in the DTD parser reachable through parameter-entity references
  • debian/patches/CVE-2026-6653.patch: drop the post-inputPush XML_PARSER_EOF early return from xmlPushInput() in parser.c. It reported an already-halted parser as a push failure after ownership of the input had been transferred, so xmlParsePEReference() freed the input still installed as ctxt->input and xmlParseInternalSubset() read through the dangling pointer. The flaw is introduced by the CVE-2021-3541 backport, not by the shipped version.
  • CVE-2026-6653

Exponential entity expansion attack bypasses all existing protection mechanisms. (CVE-2021-3541).

The qtwebengine5 package has been updated to version 5.15.8, fixing several security issues in the bundled chromium code. See the referenced package announcement for details.

This update for libxml2 fixes the following issues:

• CVE-2021-3541: Fixed exponential entity expansion attack bypasses all existing protection mechanisms. (bsc#1186015)

This update was imported from the SUSE:SLE-15:Update update project.

This update for libxml2 fixes the following issues:

• CVE-2021-3541: Fixed exponential entity expansion attack bypasses all existing protection mechanisms. (bsc#1186015)

These are all security issues fixed in the libxml2-2-2.9.12-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby2.7-rubygem-nokogiri-1.12.3-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libQt5Pdf5-5.15.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

This update for libxml2 fixes the following issues:

• CVE-2021-3541: Fixed exponential entity expansion attack bypasses all existing protection mechanisms. (bsc#1186015)

This update for libxml2 fixes the following issues:

• CVE-2021-3541: Fixed exponential entity expansion attack that could bypass all existing protection mechanisms (bsc#1186015).

This update for libxml2 fixes the following issues:

• CVE-2023-29469: Fixed inconsistent result when hashing empty strings (bsc#1210412).

• CVE-2023-28484: Fixed NULL pointer dereference in xmlSchemaFixupComplexType (bsc#1210411).

• CVE-2022-29824: Fixed integer overflow leading to out-of-bounds write in buf.c (bsc#1199132).

  The following non-security bugs were fixed:

• Added W3C conformance tests to the testsuite (bsc#1204585).

• Fixed NULL pointer dereference when parsing invalid data (glgo#libxml2!15) (bsc#1065270) .

Yunho Kim discovered that libxml2 incorrectly handled certain error conditions. A remote attacker could exploit this with a crafted XML file to cause a denial of service, or possibly cause libxml2 to expose sensitive information. This issue only affected Ubuntu 14.04 ESM, and Ubuntu 16.04 ESM. (CVE-2017-8872)

Zhipeng Xie discovered that libxml2 incorrectly handled certain XML schemas. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS. (CVE-2019-20388)

It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A remote attacker could possibly exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-24977)

It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A remote attacker could possibly exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. (CVE-2021-3517)

It was discovered that libxml2 did not properly handle certain crafted XML files. A local attacker could exploit this with a crafted input to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3516, CVE-2021-3518)

It was discovered that libxml2 incorrectly handled error states. A remote attacker could exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. (CVE-2021-3537)

Sebastian Pipping discovered that libxml2 did not properly handle certain crafted XML files. A remote attacker could exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3541)