ALPINE-CVE-2021-3517

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2021-3517
Published: 19 May 2021, 14:15
Last modified:03 Dec 2025, 22:48

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
8.6 HIGH
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 May 2021, 14:15
Published
Vulnerability first disclosed
03 Dec 2025, 22:48
Last Modified
Vulnerability information updated

Description

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

CVSS Metrics

  • v3.1•HIGH•Score: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected Systems

  • alpine•libxml2

    < 2.9.9-r5 | < 2.9.10-r5 | < 2.9.10-r6 | < 2.9.10-r7 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0 | < 2.9.11-r0

References (1)