Log in Start free

Vulnerability · Published Oct 20, 2021 · Assigned by mitre

CVE-2021-42762

Medium 5.3

In plain English

A medium-severity security flaw in the webkit2gtk package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20webkit2gtk2.34.1-r0ALPINE-CVE-2021-42762
Debian:12webkit2gtk2.34.1-1DEBIAN-CVE-2021-42762
Debian:13webkit2gtk2.34.1-1DEBIAN-CVE-2021-42762
Debian:14webkit2gtk2.34.1-1DEBIAN-CVE-2021-42762
Debian:12wpewebkit2.34.1-1DEBIAN-CVE-2021-42762
Debian:13wpewebkit2.34.1-1DEBIAN-CVE-2021-42762
Debian:14wpewebkit2.34.1-1DEBIAN-CVE-2021-42762
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2021-42762
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2021-42762
Ubuntu:22.04:LTSwebkit2gtk2.34.1-1ubuntu1UBUNTU-CVE-2021-42762
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2021-42762

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References