Vulnerability · Published Jul 8, 2021 · Assigned by talos
CVE-2021-21806
High 8.8
In plain English
A high-severity security flaw in Webkit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)2.8%top 13.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in remote code execution. The victim needs to visit a malicious web site to trigger the vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | LibRaw | 0.19.5-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | LibRaw-devel | 0.19.5-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | accountsservice | 0.6.55-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | accountsservice-devel | 0.6.55-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | accountsservice-libs | 0.6.55-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gdm | 1:40.0-15.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-autoar | 0.2.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-calculator | 3.28.2-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-classic-session | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-control-center | 3.28.2-28.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-control-center-filesystem | 3.28.2-28.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-online-accounts | 3.28.2-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-online-accounts-devel | 3.28.2-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session-kiosk-session | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session-wayland-session | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session-xsession | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-settings-daemon | 3.32.0-16.el8.alma | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell | 3.32.2-40.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-apps-menu | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-auto-move-windows | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-common | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-dash-to-dock | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-desktop-icons | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-disable-screenshield | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-drive-menu | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-gesture-inhibitor | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-horizontal-workspaces | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-launch-new-instance | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-native-window-placement | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-no-hot-corner | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-panel-favorites | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-places-menu | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-screenshot-window-sizer | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-systemMonitor | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-top-icons | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-updates-dialog | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-user-theme | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-window-grouper | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-window-list | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-windowsNavigator | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-workspace-indicator | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-software | 3.36.1-10.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-software-devel | 3.36.1-10.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gsettings-desktop-schemas | 3.32.0-6.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gsettings-desktop-schemas-devel | 3.32.0-6.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk-update-icon-cache | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk3 | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk3-devel | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk3-immodule-xim | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | mutter | 3.32.2-60.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | mutter-devel | 3.32.2-60.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | vino | 3.22.0-11.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3 | 2.32.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3-devel | 2.32.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3-jsc | 2.32.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3-jsc-devel | 2.32.3-2.el8 | ALSA-2021:4381 |
| Alpine:v3.20 | webkit2gtk | 2.30.6-r0 | ALPINE-CVE-2021-21806 |
| Debian:12 | webkit2gtk | 2.30.6-1 | DEBIAN-CVE-2021-21806 |
| Debian:13 | webkit2gtk | 2.30.6-1 | DEBIAN-CVE-2021-21806 |
| Debian:14 | webkit2gtk | 2.30.6-1 | DEBIAN-CVE-2021-21806 |
| Debian:12 | wpewebkit | 2.30.6-1 | DEBIAN-CVE-2021-21806 |
| Debian:13 | wpewebkit | 2.30.6-1 | DEBIAN-CVE-2021-21806 |
| Debian:14 | wpewebkit | 2.30.6-1 | DEBIAN-CVE-2021-21806 |
| Rocky Linux:8 | LibRaw | 0:0.19.5-3.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | accountsservice | 0:0.6.55-2.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gdm | 1:40.0-15.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-autoar | 0:0.2.3-2.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-calculator | 0:3.28.2-2.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-control-center | 0:3.28.2-28.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-online-accounts | 0:3.28.2-3.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-session | 0:3.28.1-13.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-settings-daemon | 0:3.32.0-16.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-settings-daemon | 0:3.32.0-16.el8_6.1 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-shell | 0:3.32.2-40.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-shell-extensions | 0:3.32.1-20.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-software | 0:3.36.1-10.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gsettings-desktop-schemas | 0:3.32.0-6.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gtk3 | 0:3.22.30-8.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | mutter | 0:3.32.2-60.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | vino | 0:3.22.0-11.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | webkit2gtk3 | 0:2.32.3-2.el8 | RLSA-2021:4381 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-21806 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-21806 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2021-21806 |
Affected products (as reported)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1214 x_refsource_MISC
- [oss-security] 20210723 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0004 mailing-list, x_refsource_MLIST