CVE-2021-42762
CVE-2021-42762
This page contains facts from public vulnerability sources. Check the original advisory before updating.
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
CVSS 5.3 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
webkit2gtk Debian:12
- Affected ranges
- ECOSYSTEM: < 2.34.1-1
Update to 2.34.1-1
webkit2gtk Debian:13
- Affected ranges
- ECOSYSTEM: < 2.34.1-1
Update to 2.34.1-1
webkit2gtk Debian:14
- Affected ranges
- ECOSYSTEM: < 2.34.1-1
Update to 2.34.1-1
wpewebkit Debian:12
- Affected ranges
- ECOSYSTEM: < 2.34.1-1
Update to 2.34.1-1
wpewebkit Debian:13
- Affected ranges
- ECOSYSTEM: < 2.34.1-1
Update to 2.34.1-1
wpewebkit Debian:14
- Affected ranges
- ECOSYSTEM: < 2.34.1-1
Update to 2.34.1-1
qtwebkit-opensource-src Ubuntu:16.04:LTS
- Versions
- 5.4.2+dfsg-1ubuntu2.1
- 5.5.1+dfsg-2ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
webkit2gtk Ubuntu:16.04:LTS
- Versions
- 2.8.5+dfsg1-3
- 2.10.3+dfsg1-1
- 2.10.4+dfsg1-1
- 2.10.5-1
- 2.10.6-1
- 2.10.6-1ubuntu1
- 2.10.8-1ubuntu1
- 2.10.9-1ubuntu1
- 2.12.5-0ubuntu0.16.04.1
- 2.14.2-0ubuntu0.16.04.1
- 2.14.3-0ubuntu0.16.04.1
- 2.14.5-0ubuntu0.16.04.1
- 2.16.1-0ubuntu0.16.04.1
- 2.16.1-0ubuntu0.16.04.2
- 2.16.2-0ubuntu0.16.04.1
- 2.16.3-0ubuntu0.16.04.1
- 2.16.6-0ubuntu0.16.04.1
- 2.18.0-0ubuntu0.16.04.2
- 2.18.3-0ubuntu0.16.04.1
- 2.18.4-0ubuntu0.16.04.1
- 2.18.5-0ubuntu0.16.04.1
- 2.18.6-0ubuntu0.16.04.1
- 2.20.1-0ubuntu0.16.04.1
- 2.20.2-0ubuntu0.16.04.1
- 2.20.3-0ubuntu0.16.04.1
- 2.20.5-0ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebkit-source Ubuntu:16.04:LTS
- Versions
- 2.3.2-0ubuntu10
- 2.3.2-0ubuntu11
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
webkitgtk Ubuntu:16.04:LTS
- Versions
- 2.4.9-2ubuntu2
- 2.4.10-0ubuntu1
- 2.4.11-0ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebkit-opensource-src Ubuntu:18.04:LTS
- Versions
- 5.9.1+dfsg-5ubuntu1
- 5.9.1+dfsg-5ubuntu3
- 5.212.0~alpha2-5build2
- 5.212.0~alpha2-5build4
- 5.212.0~alpha2-7
- 5.212.0~alpha2-7build2
- 5.212.0~alpha2-7ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebkit-source Ubuntu:18.04:LTS
- Versions
- 2.3.2-0ubuntu13
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
webkitgtk Ubuntu:18.04:LTS
- Versions
- 2.4.11-3
- 2.4.11-3ubuntu2
- 2.4.11-3ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
webkit2gtk Ubuntu:20.04:LTS
- Versions
- 2.26.1-3
- 2.26.2-1
- 2.26.3-1ubuntu2
- 2.26.4-1ubuntu1
- 2.28.0-1ubuntu2
- 2.28.1-1
- 2.28.2-0ubuntu0.20.04.1
- 2.28.3-0ubuntu0.20.04.1
- 2.28.4-0ubuntu0.20.04.1
- 2.30.3-0ubuntu0.20.04.1
- 2.30.5-0ubuntu0.20.04.1
- 2.30.6-0ubuntu0.20.04.1
- 2.32.0-0ubuntu0.20.04.1
- 2.32.3-0ubuntu0.20.04.1
- 2.32.4-0ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: < 2.34.1-0ubuntu0.20.04.1
Update to 2.34.1-0ubuntu0.20.04.1
qtwebkit-opensource-src Ubuntu:20.04:LTS
- Versions
- 5.212.0~alpha3-3
- 5.212.0~alpha3-5
- 5.212.0~alpha3-6
- 5.212.0~alpha3-7
- 5.212.0~alpha4-1
- 5.212.0~alpha4-1ubuntu1
- 5.212.0~alpha4-1ubuntu2
- 5.212.0~alpha4-1ubuntu2.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wpewebkit Ubuntu:20.04:LTS
- Versions
- 2.26.3-1
- 2.26.4-1
- 2.26.4-1build1
- 2.28.0-1
- 2.28.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebkit-opensource-src Ubuntu:22.04:LTS
- Versions
- 5.212.0~alpha4-12
- 5.212.0~alpha4-13
- 5.212.0~alpha4-14
- 5.212.0~alpha4-14build1
- 5.212.0~alpha4-14ubuntu2
- 5.212.0~alpha4-15ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
webkit2gtk Ubuntu:22.04:LTS
- Versions
- 2.34.0-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 2.34.1-1ubuntu1
Update to 2.34.1-1ubuntu1
wpewebkit Ubuntu:22.04:LTS
- Versions
- 2.32.4-1
- 2.34.1-1
- 2.34.2-1
- 2.34.3-1
- 2.34.4-1
- 2.34.5-1
- 2.34.6-1
- 2.36.0-2ubuntu2
- 2.36.0-2ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebkit-opensource-src Ubuntu:24.04:LTS
- Versions
- 5.212.0~alpha4-33
- 5.212.0~alpha4-33build1
- 5.212.0~alpha4-34
- 5.212.0~alpha4-34ubuntu3
- 5.212.0~alpha4-34ubuntu4
- 5.212.0~alpha4-36
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
- https://bugs.webkit.org/show_bug.cgi?id=231479
- http://www.openwall.com/lists/oss-security/2021/10/26/9
- http://www.openwall.com/lists/oss-security/2021/10/27/1
- http://www.openwall.com/lists/oss-security/2021/10/27/2
- http://www.openwall.com/lists/oss-security/2021/10/27/4
- https://www.debian.org/security/2021/dsa-4995
- https://www.debian.org/security/2021/dsa-4996
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/
- https://nvd.nist.gov/vuln/detail/CVE-2021-42762