一、漏洞信息

漏洞编号：[CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)

漏洞归属组件：libxml2

漏洞归属的版本：2.9.9,2.9.8,2.9.10

CVSS V3.0分值：

BaseScore：8.6 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

漏洞简述：

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

漏洞公开时间：2021-05-19 22:15

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2021-3517

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS(2.9.10):

2.openEuler-20.03-LTS-SP1(2.9.10):

一、漏洞信息

漏洞编号：[CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)

漏洞归属组件：libxml2

漏洞归属的版本：2.9.9,2.9.8,2.9.10

CVSS V3.0分值：

BaseScore：8.6 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

漏洞简述：

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

漏洞创建时间：2021-05-26 13:30:43

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2021-3517

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

一、漏洞信息

漏洞编号：[CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)

漏洞归属组件：libxml2

漏洞归属的版本：2.9.9,2.9.8,2.9.10

CVSS V3.0分值：

BaseScore：8.6 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

漏洞简述：

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

漏洞公开时间：2021-05-19

漏洞创建时间：2021-05-26 13:30:43

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2021-3517

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

8.6

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS(2.9.10):

2.openEuler-20.03-LTS-SP1(2.9.10):

一、漏洞信息

漏洞编号：[CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)

漏洞归属组件：libxml2

漏洞归属的版本：2.9.9,2.9.8,2.9.10

CVSS V3.0分值：

BaseScore：8.6 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

漏洞简述：

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

漏洞公开时间：2021-05-19

漏洞创建时间：2021-05-26 13:30:43

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2021-3517

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

8.6

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

受影响版本排查(受影响/不受影响)：

一、漏洞信息

漏洞编号：[CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)

漏洞归属组件：libxml2

漏洞归属的版本：2.9.9,2.9.8,2.9.10

CVSS V3.0分值：

BaseScore：8.6 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

漏洞简述：

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

漏洞公开时间：2021-05-19

漏洞创建时间：2021-05-26 13:30:43

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2021-3517

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md

二、漏洞分析结构反馈

影响性分析说明：

在2.9.11之前的版本中，攻击者通过提供一个由libxml2的受影响功能链接的应用程序处理的特制文件，造成越界读取，影响功能的可用性。但是如果攻击者能够使用内存信息来进一步利用该应用程序，则可能会对机密性和完整性产生某些潜在的影响。

openEuler评分：

8.6

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS(2.9.10):受影响

2.openEuler-20.03-LTS-SP1(2.9.10):受影响

3.openEuler-21.03(2.9.10):受影响

4.openEuler-20.03-LTS-Next(2.9.10):受影响

5.openEuler-20.03-LTS-SP2(2.9.10):受影响

6.master(2.9.10):受影响

是否涉及abi变化(是/否)：

一、漏洞信息

漏洞编号：[CVE-2021-3517](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)

漏洞归属组件：libxml2

漏洞归属的版本：2.9.9,2.9.8,2.9.10

CVSS V3.0分值：

BaseScore：8.6 High

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

漏洞简述：

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

漏洞创建时间：2021-05-26 13:30:43

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2021-3517

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md

二、漏洞分析结构反馈

影响性分析说明：

在2.9.11之前的版本中，攻击者通过提供一个由libxml2的受影响功能链接的应用程序处理的特制文件，造成越界读取，影响功能的可用性。但是如果攻击者能够使用内存信息来进一步利用该应用程序，则可能会对机密性和完整性产生某些潜在的影响。

openEuler评分：

8.6

Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS(2.9.10):受影响

2.openEuler-20.03-LTS-SP1(2.9.10):受影响

3.openEuler-21.03(2.9.10):受影响

4.openEuler-20.03-LTS-Next(2.9.10):受影响

5.openEuler-20.03-LTS-SP2(2.9.10):受影响

6.master(2.9.10):受影响

2.openEuler-20.03-LTS-SP1(2.9.10):否