CVE-2021-3517: Debian Linux

High severity, CVSS 8.6. EPSS: 17% chance of exploitation in the next 30 days.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Affected products

Debian Debian Linux: version 9.0 only
Fedoraproject Fedora: version 33 only; version 34 only
Netapp Active Iq Unified Manager: affected versions not specified
Netapp Clustered Data Ontap: affected versions not specified
Netapp Clustered Data Ontap Antivirus Connector: affected versions not specified
Netapp E-Series Santricity OS Controller: from 11.0.0, up to and including 11.70.1
Netapp E-Series Santricity Storage Manager: affected versions not specified
Netapp E-Series Santricity Web Services: affected versions not specified
Netapp Hci h410c Firmware: affected versions not specified
Netapp Hci Management Node: affected versions not specified
Netapp Manageability Software Development Kit: affected versions not specified
Netapp Oncommand Insight: affected versions not specified
Netapp Oncommand Workflow Automation: affected versions not specified
Netapp Ontap Select Deploy Administration Utility: affected versions not specified
Netapp Santricity Unified Manager: affected versions not specified
Netapp Snapdrive: affected versions not specified
Netapp Snapmanager: affected versions not specified
Netapp Solidfire: affected versions not specified
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
Oracle Enterprise Manager Base Platform: version 13.4.0.0 only; version 13.5.0.0 only
Oracle MySQL Workbench: up to and including 8.0.26
Oracle Openjdk: version 8 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
Oracle Real User Experience Insight: version 13.4.1.0 only; version 13.5.1.0 only
Oracle ZFS Storage Appliance Kit: version 8.8 only
and 3 more

Published 2021-05-19. Last modified 2026-06-17.