CVE-2021-3518: Debian Linux
High severity, CVSS 8.8. EPSS: 21.9% chance of exploitation in the next 30 days.
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Affected products
- Debian Debian Linux: version 9.0 only
- Fedoraproject Fedora: version 33 only; version 34 only
- Netapp Active Iq Unified Manager: affected versions not specified
- Netapp Clustered Data Ontap: affected versions not specified
- Netapp Clustered Data Ontap Antivirus Connector: affected versions not specified
- Netapp Hci h410c Firmware: affected versions not specified
- Netapp Manageability Software Development Kit: affected versions not specified
- Netapp Ontap Select Deploy Administration Utility: affected versions not specified
- Netapp Snapdrive: affected versions not specified
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
- Oracle Enterprise Manager Base Platform: version 13.4.0.0 only; version 13.5.0.0 only
- Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
- Oracle MySQL Workbench: up to and including 8.0.26
- Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
- Oracle Real User Experience Insight: version 13.4.1.0 only; version 13.5.1.0 only
- Red Hat Enterprise Linux: version 8.0 only
- Red Hat JBoss Core Services: affected versions not specified
- Xmlsoft LIBXML2: before 2.9.11 (fixed in 2.9.11)
Published 2021-05-18. Last modified 2026-06-17.