Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CentOS libxml2 may allow crashes or code execution
published 4 years ago
Summary
The libxml2 library used on CentOS systems can be tricked into processing specially crafted XML files, leading to crashes, memory corruption, or even execution of unwanted code. This affects the libxml2 packages and any applications that rely on them, such as those using the xmllint tool. Update the libxml2 packages to the latest version that includes the security fixes.
What to do
- Update centos libxml2 to version 2.7.6-21.el6_8.1.tuxcare.els1.
- Update centos libxml2-devel to version 2.7.6-21.el6_8.1.tuxcare.els1.
- Update centos libxml2-python to version 2.7.6-21.el6_8.1.tuxcare.els1.
- Update centos libxml2-static to version 2.7.6-21.el6_8.1.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:6 | centos | libxml2 |
< 2.7.6-21.el6_8.1.tuxcare.els1 Fix: upgrade to 2.7.6-21.el6_8.1.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | libxml2-devel |
< 2.7.6-21.el6_8.1.tuxcare.els1 Fix: upgrade to 2.7.6-21.el6_8.1.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | libxml2-python |
< 2.7.6-21.el6_8.1.tuxcare.els1 Fix: upgrade to 2.7.6-21.el6_8.1.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | libxml2-static |
< 2.7.6-21.el6_8.1.tuxcare.els1 Fix: upgrade to 2.7.6-21.el6_8.1.tuxcare.els1
|
Original advisory text
Fix of 8 CVEs
- CVE-2021-3517.patch: validate UTF8 in xmlEncodeEntities
- CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'
- CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv
- CVE-2021-3541.patch: parser fix for the billion laughs attack
- CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'
- CVE-2017-8872.patch: free input buffer in xmlHaltParser
- CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream
- CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'
- CVE-2021-3518.patch: fix user-after-free with 'xmllint --xinclude --dropdtd'
- CVE-2021-3537.patch: propagate error in xmlParseElementChildrenContentDeclPriv
- CVE-2021-3541.patch: parser fix for the billion laughs attack
- CVE-2021-3516.patch: fix use-after-free with 'xmllint --html --push'
- CVE-2017-8872.patch: free input buffer in xmlHaltParser
- CVE-2019-20388.patch: fix memory leak in xmlSchemaValidateStream
- CVE-2020-24977.patch: fix out-of-bounds read with 'xmllint --htmlout'
References
- https://errata.cloudlinux.com/els6/CLSA-2022-1641903536.html Vendor Advisory
Timeline
Published11 Jan 2022
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2022-1641903536 · OSV
Track software like this
Free during beta