JLSEC-2025-72

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-72.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-72.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2025-72

Upstream

CVE-2021-3517

Published

2025-10-17T17:40:51.659Z

Modified

2025-11-06T23:02:50.735645Z

Summary

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11

Details

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-3517",
            "id": "CVE-2021-3517",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517",
            "published": "2021-05-19T14:15:07.553Z",
            "modified": "2024-11-21T06:21:44.107Z",
            "imported": "2025-10-28T18:09:07.779Z"
        }
    ]
}

References

Affected packages

Julia / XML2_jll

Package

Name: XML2_jll
Purl: pkg:julia/XML2_jll?uuid=02c8fc9c-b97f-50b9-bbe4-9be30ff0a78a

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.9.12+0