Vulnerability · Published Jul 7, 2021 · Assigned by talos
CVE-2021-21775
Medium 6.8
In plain English
A medium-severity use-after-free in Webkit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)6.8Medium
Exploit odds (30 days)1.3%top 30.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | LibRaw | 0.19.5-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | LibRaw-devel | 0.19.5-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | accountsservice | 0.6.55-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | accountsservice-devel | 0.6.55-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | accountsservice-libs | 0.6.55-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gdm | 1:40.0-15.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-autoar | 0.2.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-calculator | 3.28.2-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-classic-session | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-control-center | 3.28.2-28.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-control-center-filesystem | 3.28.2-28.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-online-accounts | 3.28.2-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-online-accounts-devel | 3.28.2-3.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session-kiosk-session | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session-wayland-session | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-session-xsession | 3.28.1-13.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-settings-daemon | 3.32.0-16.el8.alma | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell | 3.32.2-40.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-apps-menu | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-auto-move-windows | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-common | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-dash-to-dock | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-desktop-icons | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-disable-screenshield | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-drive-menu | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-gesture-inhibitor | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-horizontal-workspaces | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-launch-new-instance | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-native-window-placement | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-no-hot-corner | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-panel-favorites | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-places-menu | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-screenshot-window-sizer | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-systemMonitor | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-top-icons | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-updates-dialog | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-user-theme | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-window-grouper | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-window-list | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-windowsNavigator | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-shell-extension-workspace-indicator | 3.32.1-20.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-software | 3.36.1-10.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gnome-software-devel | 3.36.1-10.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gsettings-desktop-schemas | 3.32.0-6.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gsettings-desktop-schemas-devel | 3.32.0-6.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk-update-icon-cache | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk3 | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk3-devel | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | gtk3-immodule-xim | 3.22.30-8.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | mutter | 3.32.2-60.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | mutter-devel | 3.32.2-60.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | vino | 3.22.0-11.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3 | 2.32.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3-devel | 2.32.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3-jsc | 2.32.3-2.el8 | ALSA-2021:4381 |
| AlmaLinux:8 | webkit2gtk3-jsc-devel | 2.32.3-2.el8 | ALSA-2021:4381 |
| Alpine:v3.20 | webkit2gtk | 2.32.3-r0 | ALPINE-CVE-2021-21775 |
| Debian:12 | webkit2gtk | 2.32.3-1 | DEBIAN-CVE-2021-21775 |
| Debian:13 | webkit2gtk | 2.32.3-1 | DEBIAN-CVE-2021-21775 |
| Debian:14 | webkit2gtk | 2.32.3-1 | DEBIAN-CVE-2021-21775 |
| Debian:12 | wpewebkit | 2.32.3-1 | DEBIAN-CVE-2021-21775 |
| Debian:13 | wpewebkit | 2.32.3-1 | DEBIAN-CVE-2021-21775 |
| Debian:14 | wpewebkit | 2.32.3-1 | DEBIAN-CVE-2021-21775 |
| Rocky Linux:8 | LibRaw | 0:0.19.5-3.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | accountsservice | 0:0.6.55-2.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gdm | 1:40.0-15.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-autoar | 0:0.2.3-2.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-calculator | 0:3.28.2-2.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-control-center | 0:3.28.2-28.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-online-accounts | 0:3.28.2-3.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-session | 0:3.28.1-13.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-settings-daemon | 0:3.32.0-16.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-settings-daemon | 0:3.32.0-16.el8_6.1 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-shell | 0:3.32.2-40.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-shell-extensions | 0:3.32.1-20.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gnome-software | 0:3.36.1-10.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gsettings-desktop-schemas | 0:3.32.0-6.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | gtk3 | 0:3.22.30-8.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | mutter | 0:3.32.2-60.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | vino | 0:3.22.0-11.el8 | RLSA-2021:4381 |
| Rocky Linux:8 | webkit2gtk3 | 0:2.32.3-2.el8 | RLSA-2021:4381 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-21775 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-21775 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2021-21775 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1229 x_refsource_MISC
- [oss-security] 20210723 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0004 mailing-list, x_refsource_MLIST
- FEDORA-2021-cf7d8c7b1a vendor-advisory, x_refsource_FEDORA
- DSA-4945 vendor-advisory, x_refsource_DEBIAN
- FEDORA-2021-3de956ceee vendor-advisory, x_refsource_FEDORA