Cyber Resilience

CVE-2021-3537

Medium

Published: 14 May 2021

Published
14 May 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0011 29.2th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-3537 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.9 (Medium).

Operationally, ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could…

more

be used to crash the application. The highest threat from this vulnerability is to system availability.

CWE(s)
CWE-476

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

xmlsoft
libxml2
≤ 2.9.11
redhat
jboss core services
all versions
redhat
enterprise linux
6.0, 7.0, 8.0
debian
debian linux
9.0
fedoraproject
fedora
33, 34
netapp
active iq unified manager
all versions
netapp
clustered data ontap
all versions
netapp
clustered data ontap antivirus connector
all versions
netapp
manageability software development kit
all versions
netapp
ontap select deploy administration utility
all versions
+9 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References