There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Se presenta un fallo en la funcionalidad xml entity encoding de libxml2 en versiones anteriores a 2.9.11. Un atacante que sea capaz de proporcionar un archivo diseñado para que sea procesado por una aplicación vinculada con la funcionalidad afectada de libxml2 podría desencadenar una lectura fuera de los límites. El impacto más probable de este fallo es la disponibilidad de la aplicación, con algún impacto potencial en la confidencialidad e integridad si un atacante puede usar la información de la memoria para explotar aún más la aplicación
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-787
|
| [email protected] | Secondary |
en
CWE-787
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-125
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| xmlsoft | libxml2 | * | <built-in method update of dict object at 0x7fd36adf6940> | Application |
| redhat | jboss_core_services | - | <built-in method update of dict object at 0x7fd39c4d7200> | Application |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd3686ecdc0> | Operating System |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd39c4d6380> | Operating System |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7fd36adf4bc0> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd39c4d79c0> | Operating System |
| netapp | active_iq_unified_manager | - | <built-in method update of dict object at 0x7fd385617cc0> | Application |
| netapp | active_iq_unified_manager | - | <built-in method update of dict object at 0x7fd39c4d7b00> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd39c4d7d40> | Application |
| netapp | clustered_data_ontap_antivirus_connector | - | <built-in method update of dict object at 0x7fd36adf5c40> | Application |
| netapp | e-series_santricity_os_controller | * | <built-in method update of dict object at 0x7fd3841205c0> | Application |
| netapp | e-series_santricity_storage_manager | - | <built-in method update of dict object at 0x7fd39c4d5b00> | Application |
| netapp | e-series_santricity_web_services | - | <built-in method update of dict object at 0x7fd3688a77c0> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd39c4d7f40> | Application |
| netapp | manageability_software_development_kit | - | <built-in method update of dict object at 0x7fd36b437c80> | Application |
| netapp | oncommand_insight | - | <built-in method update of dict object at 0x7fd385615680> | Application |
| netapp | oncommand_workflow_automation | - | <built-in method update of dict object at 0x7fd39c4a63c0> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd3846829c0> | Application |
| netapp | santricity_unified_manager | - | <built-in method update of dict object at 0x7fd3688a5bc0> | Application |
| netapp | snapdrive | - | <built-in method update of dict object at 0x7fd39c436e00> | Application |
| netapp | snapmanager | - | <built-in method update of dict object at 0x7fd3685302c0> | Application |
| netapp | snapmanager | - | <built-in method update of dict object at 0x7fd39c4d57c0> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd36adf5280> | Application |
| netapp | hci_h410c_firmware | - | <built-in method update of dict object at 0x7fd39c4d4ec0> | Operating System |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | <built-in method update of dict object at 0x7fd384680600> | Application |
| oracle | enterprise_manager_base_platform | 13.4.0.0 | <built-in method update of dict object at 0x7fd3686ee680> | Application |
| oracle | enterprise_manager_base_platform | 13.5.0.0 | <built-in method update of dict object at 0x7fd39c4d5380> | Application |
| oracle | mysql_workbench | * | <built-in method update of dict object at 0x7fd3854be2c0> | Application |
| oracle | openjdk | 8 | <built-in method update of dict object at 0x7fd36adf4a40> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.58 | <built-in method update of dict object at 0x7fd289ced3c0> | Application |
| oracle | real_user_experience_insight | 13.4.1.0 | <built-in method update of dict object at 0x7fd348bbdfc0> | Application |
| oracle | real_user_experience_insight | 13.5.1.0 | <built-in method update of dict object at 0x7fd39c4a77c0> | Application |
| oracle | zfs_storage_appliance_kit | 8.8 | <built-in method update of dict object at 0x7fd37015dc00> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:* |
| Yes | cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* |
| Yes | cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* |