Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0764-1 Final 1 1 2021-05-22T05:03:59Z current 2021-05-22T05:03:59Z 2021-05-22T05:03:59Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update for libxml2 fixes the following issues: - CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel (bsc#1185698) - CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408). - CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410). - CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-764 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32MGTWHTQRUPYHYIAVT6OVBDWQDI36DX/ E-Mail link for openSUSE-SU-2021:0764-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1185408 SUSE Bug 1185408 https://bugzilla.suse.com/1185409 SUSE Bug 1185409 https://bugzilla.suse.com/1185410 SUSE Bug 1185410 https://bugzilla.suse.com/1185698 SUSE Bug 1185698 https://www.suse.com/security/cve/CVE-2021-3516/ SUSE CVE CVE-2021-3516 page https://www.suse.com/security/cve/CVE-2021-3517/ SUSE CVE CVE-2021-3517 page https://www.suse.com/security/cve/CVE-2021-3518/ SUSE CVE CVE-2021-3518 page https://www.suse.com/security/cve/CVE-2021-3537/ SUSE CVE CVE-2021-3537 page openSUSE Leap 15.2 libxml2-2-2.9.7-lp152.10.12.1 libxml2-2-32bit-2.9.7-lp152.10.12.1 libxml2-devel-2.9.7-lp152.10.12.1 libxml2-devel-32bit-2.9.7-lp152.10.12.1 libxml2-doc-2.9.7-lp152.10.12.1 libxml2-tools-2.9.7-lp152.10.12.1 python2-libxml2-python-2.9.7-lp152.10.12.1 python3-libxml2-python-2.9.7-lp152.10.12.1 libxml2-2-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 libxml2-2-32bit-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 libxml2-devel-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 libxml2-devel-32bit-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 libxml2-doc-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 libxml2-tools-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 python2-libxml2-python-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 python3-libxml2-python-2.9.7-lp152.10.12.1 as a component of openSUSE Leap 15.2 There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability. CVE-2021-3516 openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-doc-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-tools-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python2-libxml2-python-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python3-libxml2-python-2.9.7-lp152.10.12.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32MGTWHTQRUPYHYIAVT6OVBDWQDI36DX/ https://www.suse.com/security/cve/CVE-2021-3516.html CVE-2021-3516 https://bugzilla.suse.com/1185409 SUSE Bug 1185409 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. CVE-2021-3517 openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-doc-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-tools-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python2-libxml2-python-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python3-libxml2-python-2.9.7-lp152.10.12.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32MGTWHTQRUPYHYIAVT6OVBDWQDI36DX/ https://www.suse.com/security/cve/CVE-2021-3517.html CVE-2021-3517 https://bugzilla.suse.com/1185410 SUSE Bug 1185410 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 https://bugzilla.suse.com/1194438 SUSE Bug 1194438 https://bugzilla.suse.com/1196383 SUSE Bug 1196383 There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. CVE-2021-3518 openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-doc-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-tools-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python2-libxml2-python-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python3-libxml2-python-2.9.7-lp152.10.12.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32MGTWHTQRUPYHYIAVT6OVBDWQDI36DX/ https://www.suse.com/security/cve/CVE-2021-3518.html CVE-2021-3518 https://bugzilla.suse.com/1185408 SUSE Bug 1185408 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability. CVE-2021-3537 openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-doc-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:libxml2-tools-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python2-libxml2-python-2.9.7-lp152.10.12.1 openSUSE Leap 15.2:python3-libxml2-python-2.9.7-lp152.10.12.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32MGTWHTQRUPYHYIAVT6OVBDWQDI36DX/ https://www.suse.com/security/cve/CVE-2021-3537.html CVE-2021-3537 https://bugzilla.suse.com/1185698 SUSE Bug 1185698