CVE catalog

CVE-2021-3516

libxml2: CVE-2021-3516

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.04% · Oct 25, 2026

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxml2sid2.15.4+dfsg-1fixed
Debianlibxml2forky2.15.4+dfsg-1fixed
Debianlibxml2trixie2.12.7+dfsg+really2.9.14-2.1+deb13u3fixed
Debianlibxml2trixie-security2.12.7+dfsg+really2.9.14-2.1+deb13u1fixed
Debianlibxml2bookworm2.9.14+dfsg-1.3~deb12u6fixed
Debianlibxml2bookworm-security2.9.14+dfsg-1.3~deb12u4fixed
CpexmllintNot reported2.9.11fixed
Cpedebian_linuxNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
Cpejboss_core_servicesNot reportedNot reportedunknown
Cpeenterprise_linuxNot reportedNot reportedunknown
Cpeclustered_data_ontapNot reportedNot reportedunknown
Cpeclustered_data_ontap_antivirus_connectorNot reportedNot reportedunknown
Cpeontap_select_deploy_administration_utilityNot reportedNot reportedunknown
Cpezfs_storage_appliance_kitNot reportedNot reportedunknown
Ubuntulibxml2pro2.9.2+zdfsg1-4vulnerable
Ubuntulibxml2pro2.9.2+zdfsg1-4ubuntu1vulnerable
Ubuntulibxml2pro2.9.2+zdfsg1-4ubuntu2vulnerable
Ubuntulibxml2pro2.9.2+zdfsg1-4ubuntu3vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.1vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.2vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.3vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.4vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.5vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.6vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7vulnerable
Ubuntulibxml2pro2.9.3+dfsg1-1ubuntu0.7+esm1fixed
Ubuntulibxml218.042.9.4+dfsg1-4ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5ubuntu2vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5.1ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-5.2ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1.2vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1.3vulnerable
Ubuntulibxml218.042.9.4+dfsg1-6.1ubuntu1.4fixed
Ubuntulibxml220.042.9.4+dfsg1-7ubuntu3vulnerable
Ubuntulibxml220.042.9.4+dfsg1-7ubuntu5vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu1vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu2vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu3vulnerable
Ubuntulibxml220.042.9.10+dfsg-1ubuntu3vulnerable
Ubuntulibxml220.042.9.10+dfsg-4build1vulnerable
Ubuntulibxml220.042.9.10+dfsg-5vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.1fixed
Suselibxml2hpe helion openstack 82.9.4-46.43.1fixed
Susepython-libxml2hpe helion openstack 82.9.4-46.43.1fixed
Suselibxml2openstack cloud 82.9.4-46.43.1fixed
Susepython-libxml2openstack cloud 82.9.4-46.43.1fixed
Suselibxml2openstack cloud 92.9.4-46.43.1fixed
Susepython-libxml2openstack cloud 92.9.4-46.43.1fixed
Suselibxml2openstack cloud crowbar 82.9.4-46.43.1fixed
Susepython-libxml2openstack cloud crowbar 82.9.4-46.43.1fixed
Suselibxml2openstack cloud crowbar 92.9.4-46.43.1fixed
Susepython-libxml2openstack cloud crowbar 92.9.4-46.43.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp32.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp32.9.4-46.43.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp42.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp42.9.4-46.43.1fixed
Suselibxml2linux enterprise software development kit 12 sp52.9.4-46.43.1fixed
Suselibxml2linux enterprise server 12 sp2-bcl2.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server 12 sp2-bcl2.9.4-46.43.1fixed
Suselibxml2linux enterprise server 12 sp3-ltss2.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server 12 sp3-ltss2.9.4-46.43.1fixed
Suselibxml2linux enterprise server 12 sp3-bcl2.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server 12 sp3-bcl2.9.4-46.43.1fixed
Suselibxml2linux enterprise server 12 sp4-ltss2.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server 12 sp4-ltss2.9.4-46.43.1fixed
Suselibxml2linux enterprise server 12 sp52.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server 12 sp52.9.4-46.43.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp52.9.4-46.43.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp52.9.4-46.43.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp22.9.7-3.31.1fixed
Susepython-libxml2-pythonlinux enterprise module for basesystem 15 sp22.9.7-3.31.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp32.9.7-3.31.1fixed
Susepython-libxml2-pythonlinux enterprise module for basesystem 15 sp32.9.7-3.31.1fixed
Susepython-libxml2-pythonlinux enterprise module for python 2 15 sp22.9.7-3.31.1fixed
Susepython-libxml2-pythonlinux enterprise module for python 2 15 sp32.9.7-3.31.1fixed
Suselibxml2linux enterprise micro 5.02.9.7-3.31.1fixed
Opensuselibxml2leap 15.22.9.7-lp152.10.12.1fixed
Opensusepython-libxml2-pythonleap 15.22.9.7-lp152.10.12.1fixed
Suselibxml2linux enterprise software development kit 12 sp52.9.4-46.40.1fixed
Suselibxml2linux enterprise server 12 sp52.9.4-46.40.1fixed
Susepython-libxml2linux enterprise server 12 sp52.9.4-46.40.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp52.9.4-46.40.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp52.9.4-46.40.1fixed
Opensuselibxml2leap 15.22.9.7-lp152.10.9.1fixed
Opensusepython-libxml2-pythonleap 15.22.9.7-lp152.10.9.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp22.9.7-3.34.1fixed
Susepython-libxml2-pythonlinux enterprise module for basesystem 15 sp22.9.7-3.34.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp32.9.7-3.34.1fixed
Susepython-libxml2-pythonlinux enterprise module for basesystem 15 sp32.9.7-3.34.1fixed
Susepython-libxml2-pythonlinux enterprise module for python 2 15 sp22.9.7-3.34.1fixed
Susepython-libxml2-pythonlinux enterprise module for python 2 15 sp32.9.7-3.34.1fixed
Suselibxml2linux enterprise micro 5.02.9.7-3.34.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxml2sourcesid2.9.10+dfsg-6.6not yet assignedNot reported[987739]
Debianlibxml2sourceforky2.9.10+dfsg-6.6not yet assignedNot reported[987739]
Debianlibxml2sourcetrixie2.9.10+dfsg-6.6not yet assignedNot reported[987739]
Debianlibxml2sourcebookworm2.9.10+dfsg-6.6not yet assignedNot reported[987739]
CpexmllintcpeNot reported2.9.11Not reportedNVD-CVE-2021-3516Not reported
Ubuntulibxml2debpro2.9.3+dfsg1-1ubuntu0.7+esm1Not reportedUBUNTU-CVE-2021-3516Not reported
Ubuntulibxml2deb18.042.9.4+dfsg1-6.1ubuntu1.4Not reportedUBUNTU-CVE-2021-3516Not reported
Ubuntulibxml2deb20.042.9.10+dfsg-5ubuntu0.20.04.1Not reportedUBUNTU-CVE-2021-3516Not reported
Suselibxml2rpmhpe helion openstack 82.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmhpe helion openstack 82.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmopenstack cloud 82.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmopenstack cloud 82.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmopenstack cloud 92.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmopenstack cloud 92.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmopenstack cloud crowbar 82.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmopenstack cloud crowbar 82.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmopenstack cloud crowbar 92.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmopenstack cloud crowbar 92.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp32.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp32.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp42.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp42.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise software development kit 12 sp52.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp2-bcl2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp2-bcl2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp3-ltss2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp3-ltss2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp3-bcl2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp3-bcl2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp4-ltss2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp4-ltss2.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp52.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp52.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.43.1Not reportedSUSE-SU-2021:1658-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp22.9.7-3.31.1Not reportedSUSE-SU-2021:1523-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for basesystem 15 sp22.9.7-3.31.1Not reportedSUSE-SU-2021:1523-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp32.9.7-3.31.1Not reportedSUSE-SU-2021:1523-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for basesystem 15 sp32.9.7-3.31.1Not reportedSUSE-SU-2021:1523-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for python 2 15 sp22.9.7-3.31.1Not reportedSUSE-SU-2021:1523-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for python 2 15 sp32.9.7-3.31.1Not reportedSUSE-SU-2021:1523-1Not reported
Suselibxml2rpmlinux enterprise micro 5.02.9.7-3.31.1Not reportedSUSE-SU-2021:1523-1Not reported
Opensuselibxml2rpmleap 15.22.9.7-lp152.10.12.1Not reportedOPENSUSE-SU-2021:0764-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.22.9.7-lp152.10.12.1Not reportedOPENSUSE-SU-2021:0764-1Not reported
Suselibxml2rpmlinux enterprise software development kit 12 sp52.9.4-46.40.1Not reportedSUSE-SU-2021:1524-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp52.9.4-46.40.1Not reportedSUSE-SU-2021:1524-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp52.9.4-46.40.1Not reportedSUSE-SU-2021:1524-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.40.1Not reportedSUSE-SU-2021:1524-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.40.1Not reportedSUSE-SU-2021:1524-1Not reported
Opensuselibxml2rpmleap 15.22.9.7-lp152.10.9.1Not reportedOPENSUSE-SU-2021:0692-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.22.9.7-lp152.10.9.1Not reportedOPENSUSE-SU-2021:0692-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp22.9.7-3.34.1Not reportedSUSE-SU-2021:1654-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for basesystem 15 sp22.9.7-3.34.1Not reportedSUSE-SU-2021:1654-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp32.9.7-3.34.1Not reportedSUSE-SU-2021:1654-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for basesystem 15 sp32.9.7-3.34.1Not reportedSUSE-SU-2021:1654-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for python 2 15 sp22.9.7-3.34.1Not reportedSUSE-SU-2021:1654-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for python 2 15 sp32.9.7-3.34.1Not reportedSUSE-SU-2021:1654-1Not reported
Suselibxml2rpmlinux enterprise micro 5.02.9.7-3.34.1Not reportedSUSE-SU-2021:1654-1Not reported

[Debian bug #987739]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxml2]Unknown
    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.6

      dsa · libxml2 · debian · bookworm

Observed:

References