medium
5.3
Advisory Published
Updated

CVE-2021-42762

First published: Wed Oct 20 2021(Updated: )

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
debian/webkit2gtk
2.36.4-1~deb10u1
2.38.6-0+deb10u1
2.40.5-1~deb11u1
2.42.1-1~deb11u2
2.40.5-1~deb12u1
2.42.1-1~deb12u1
2.42.1-2
debian/wpewebkit
2.38.6-1~deb11u1
2.38.6-1
2.42.1-1
WebKitGTK WebKitGTK<2.34.1
Wpewebkit Wpe Webkit<2.34.1
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Fedoraproject Fedora=35
Debian Debian Linux=10.0
Debian Debian Linux=11.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID?

    The vulnerability ID is CVE-2021-42762.

  • What is the severity of CVE-2021-42762?

    The severity of CVE-2021-42762 is medium with a severity value of 5.3.

  • Which software is affected by CVE-2021-42762?

    The software affected by CVE-2021-42762 includes WebKitGTK version up to 2.34.1, WPE WebKit version up to 2.34.1, webkit2gtk package on Debian, and wpewebkit package on Debian.

  • How can the vulnerability be exploited?

    The vulnerability can be exploited by a sandboxed process tricking host processes into thinking it is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace.

  • How can CVE-2021-42762 be fixed?

    To fix CVE-2021-42762, it is recommended to update to the patched versions of WebKitGTK (2.36.4-1~deb10u1 and later) and WPE WebKit (2.38.6-1~deb11u1 and later), or the latest available versions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203