Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5.3
CVSSv3

CVE-2021-42762

Published: 20/10/2021 Updated: 07/11/2023
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 5.3 | Impact Score: 3.4 | Exploitability Score: 1.8
VMScore: 409
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Webkitgtk

Vulnerability Summary

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit prior to 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

webkitgtk webkitgtk

wpewebkit wpe webkit

fedoraproject fedora 33

fedoraproject fedora 34

fedoraproject fedora 35

debian debian linux 10.0

debian debian linux 11.0

Vendor Advisories

Debian Security Advisories: DSA-4996-1 wpewebkit -- security update
The following vulnerabilities have been discovered in the wpewebkit web engine: CVE-2021-30846 Sergei Glazunov discovered that processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30851 Samuel Gross discovered that processing maliciously crafted web content may lead to code execution CVE-2021-427 ...
Debian Security Advisories: DSA-4995-1 webkit2gtk -- security update
The following vulnerabilities have been discovered in the webkit2gtk web engine: CVE-2021-30846 Sergei Glazunov discovered that processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30851 Samuel Gross discovered that processing maliciously crafted web content may lead to code execution CVE-2021-42 ...
Amazon Linux 2: ALAS2-2023-2088
A logic issue was addressed with improved state management (CVE-2020-22592) A use after free issue was addressed with improved memory management This issue is fixed in macOS Big Sur 1101, watchOS 71, iOS 142 and iPadOS 142, iCloud for Windows 115, Safari 1401, tvOS 142, iTunes 1211 for Windows Processing maliciously crafted web content ...
Red Hat: CVE-2021-42762
BubblewrapLaunchercpp in WebKitGTK and WPE WebKit before 2341 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace The impact is limited to host services that create UNIX sockets ...
Arch Linux Issues:
Severity Unknown Remote Unknown Type Unknown Description AVG-2483 webkit2gtk 2324-1 Unknown Vulnerable ...
Amazon Linux 2022: ALAS2022-2022-015
A use-after-free flaw was found in WebKitGTK Specially crafted web content could use this flaw to trigger an arbitrary code execution when processed (CVE-2021-30809) A confusion type flaw was found in WebKitGTK Specially crafted web content could use this flaw to trigger an arbitrary code execution when processed (CVE-2021-30818) A logic issue ...

Mailing Lists

Full Disclosure: Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: Salv ...
Full Disclosure: Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: Samu ...

References

NVD-CWE-Otherhttps://bugs.webkit.org/show_bug.cgi?id=231479https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4qhttp://www.openwall.com/lists/oss-security/2021/10/26/9http://www.openwall.com/lists/oss-security/2021/10/27/1http://www.openwall.com/lists/oss-security/2021/10/27/2http://www.openwall.com/lists/oss-security/2021/10/27/4https://www.debian.org/security/2021/dsa-4996https://www.debian.org/security/2021/dsa-4995https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/https://nvd.nist.govhttps://www.debian.org/security/2021/dsa-4996
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook