Vulnerability-Lookup

ubuntu-cve-2021-42762

Vulnerability from osv_ubuntu

Published

2021-10-20 19:15

Modified

2026-04-22 07:40

Summary

Details

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-42762	REPORT
	https://github.com/flatpak/flatpak/security/advis…	REPORT
	https://webkitgtk.org/security/WSA-2021-0006.html	REPORT
	https://ubuntu.com/security/notices/USN-5127-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2021-42762	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          },
          {
            "binary_name": "libqt5webkit5-qmlwebkitplugin",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          },
          {
            "binary_name": "qtwebkit5-doc-html",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.5.1+dfsg-2ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.4.2+dfsg-1ubuntu2.1",
        "5.5.1+dfsg-2ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37-gtk2",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.20.5-0ubuntu0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.5+dfsg1-3",
        "2.10.3+dfsg1-1",
        "2.10.4+dfsg1-1",
        "2.10.5-1",
        "2.10.6-1",
        "2.10.6-1ubuntu1",
        "2.10.8-1ubuntu1",
        "2.10.9-1ubuntu1",
        "2.12.5-0ubuntu0.16.04.1",
        "2.14.2-0ubuntu0.16.04.1",
        "2.14.3-0ubuntu0.16.04.1",
        "2.14.5-0ubuntu0.16.04.1",
        "2.16.1-0ubuntu0.16.04.1",
        "2.16.1-0ubuntu0.16.04.2",
        "2.16.2-0ubuntu0.16.04.1",
        "2.16.3-0ubuntu0.16.04.1",
        "2.16.6-0ubuntu0.16.04.1",
        "2.18.0-0ubuntu0.16.04.2",
        "2.18.3-0ubuntu0.16.04.1",
        "2.18.4-0ubuntu0.16.04.1",
        "2.18.5-0ubuntu0.16.04.1",
        "2.18.6-0ubuntu0.16.04.1",
        "2.20.1-0ubuntu0.16.04.1",
        "2.20.2-0ubuntu0.16.04.1",
        "2.20.3-0ubuntu0.16.04.1",
        "2.20.5-0ubuntu0.16.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqtwebkit-qmlwebkitplugin",
            "binary_version": "2.3.2-0ubuntu11"
          },
          {
            "binary_name": "libqtwebkit4",
            "binary_version": "2.3.2-0ubuntu11"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qtwebkit-source",
        "purl": "pkg:deb/ubuntu/qtwebkit-source@2.3.2-0ubuntu11?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.2-0ubuntu10",
        "2.3.2-0ubuntu11"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-3.0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-webkit-3.0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-webkit2-3.0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-1.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-bin",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkit2gtk-3.0-25",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-1.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-1.0-common",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-3.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-3.0-common",
            "binary_version": "2.4.11-0ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "webkitgtk",
        "purl": "pkg:deb/ubuntu/webkitgtk@2.4.11-0ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.9-2ubuntu2",
        "2.4.10-0ubuntu1",
        "2.4.11-0ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha2-7ubuntu1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha2-7ubuntu1"
          },
          {
            "binary_name": "qtwebkit5-doc-html",
            "binary_version": "5.212.0~alpha2-7ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha2-7ubuntu1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.9.1+dfsg-5ubuntu1",
        "5.9.1+dfsg-5ubuntu3",
        "5.212.0~alpha2-5build2",
        "5.212.0~alpha2-5build4",
        "5.212.0~alpha2-7",
        "5.212.0~alpha2-7build2",
        "5.212.0~alpha2-7ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqtwebkit-qmlwebkitplugin",
            "binary_version": "2.3.2-0ubuntu13"
          },
          {
            "binary_name": "libqtwebkit4",
            "binary_version": "2.3.2-0ubuntu13"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "qtwebkit-source",
        "purl": "pkg:deb/ubuntu/qtwebkit-source@2.3.2-0ubuntu13?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.2-0ubuntu13"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-3.0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "gir1.2-webkit-3.0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libjavascriptcoregtk-1.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-bin",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libwebkitgtk-1.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libwebkitgtk-3.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "webkitgtk",
        "purl": "pkg:deb/ubuntu/webkitgtk@2.4.11-3ubuntu3?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.11-3",
        "2.4.11-3ubuntu2",
        "2.4.11-3ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37-gtk2",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.34.1-0ubuntu0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.34.1-0ubuntu0.20.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26.1-3",
        "2.26.2-1",
        "2.26.3-1ubuntu2",
        "2.26.4-1ubuntu1",
        "2.28.0-1ubuntu2",
        "2.28.1-1",
        "2.28.2-0ubuntu0.20.04.1",
        "2.28.3-0ubuntu0.20.04.1",
        "2.28.4-0ubuntu0.20.04.1",
        "2.30.3-0ubuntu0.20.04.1",
        "2.30.5-0ubuntu0.20.04.1",
        "2.30.6-0ubuntu0.20.04.1",
        "2.32.0-0ubuntu0.20.04.1",
        "2.32.3-0ubuntu0.20.04.1",
        "2.32.4-0ubuntu0.20.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha4-1ubuntu2.1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha4-1ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha4-1ubuntu2.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.212.0~alpha3-3",
        "5.212.0~alpha3-5",
        "5.212.0~alpha3-6",
        "5.212.0~alpha3-7",
        "5.212.0~alpha4-1",
        "5.212.0~alpha4-1ubuntu1",
        "5.212.0~alpha4-1ubuntu2",
        "5.212.0~alpha4-1ubuntu2.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libwpewebkit-1.0-3",
            "binary_version": "2.28.1-1"
          },
          {
            "binary_name": "wpewebkit-driver",
            "binary_version": "2.28.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "wpewebkit",
        "purl": "pkg:deb/ubuntu/wpewebkit@2.28.1-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26.3-1",
        "2.26.4-1",
        "2.26.4-1build1",
        "2.28.0-1",
        "2.28.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha4-15ubuntu1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha4-15ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha4-15ubuntu1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.212.0~alpha4-12",
        "5.212.0~alpha4-13",
        "5.212.0~alpha4-14",
        "5.212.0~alpha4-14build1",
        "5.212.0~alpha4-14ubuntu2",
        "5.212.0~alpha4-15ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.34.1-1ubuntu1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.34.1-1ubuntu1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.34.1-1ubuntu1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.34.1-1ubuntu1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.34.1-1ubuntu1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.34.1-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.34.1-1ubuntu1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.34.1-1ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.34.0-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libwpewebkit-1.0-3",
            "binary_version": "2.36.0-2ubuntu3"
          },
          {
            "binary_name": "wpewebkit-driver",
            "binary_version": "2.36.0-2ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "wpewebkit",
        "purl": "pkg:deb/ubuntu/wpewebkit@2.36.0-2ubuntu3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.32.4-1",
        "2.34.1-1",
        "2.34.2-1",
        "2.34.3-1",
        "2.34.4-1",
        "2.34.5-1",
        "2.34.6-1",
        "2.36.0-2ubuntu2",
        "2.36.0-2ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha4-36"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha4-36"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha4-36?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.212.0~alpha4-33",
        "5.212.0~alpha4-33build1",
        "5.212.0~alpha4-34",
        "5.212.0~alpha4-34ubuntu3",
        "5.212.0~alpha4-34ubuntu4",
        "5.212.0~alpha4-36"
      ]
    }
  ],
  "aliases": [],
  "details": "BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.",
  "id": "UBUNTU-CVE-2021-42762",
  "modified": "2026-04-22T07:40:10Z",
  "published": "2021-10-20T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-42762"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q"
    },
    {
      "type": "REPORT",
      "url": "https://webkitgtk.org/security/WSA-2021-0006.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5127-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-42762"
    }
  ],
  "related": [
    "USN-5127-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-42762"
  ]
}

CVE-2021-42762 (GCVE-0-2021-42762)

Vulnerability from cvelistv5 – Published: 2021-10-20 18:15 – Updated: 2024-08-04 03:38

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
https://github.com/flatpak/flatpak/security/advis…	x_refsource_MISC
https://bugs.webkit.org/show_bug.cgi?id=231479	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2021/10/26/9	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/27/1	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/27/2	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2021/10/27/4	mailing-listx_refsource_MLIST
https://www.debian.org/security/2021/dsa-4995	vendor-advisoryx_refsource_DEBIAN
https://www.debian.org/security/2021/dsa-4996	vendor-advisoryx_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:38:50.056Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.webkit.org/show_bug.cgi?id=231479"
          },
          {
            "name": "[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/26/9"
          },
          {
            "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/27/1"
          },
          {
            "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/27/2"
          },
          {
            "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2021/10/27/4"
          },
          {
            "name": "DSA-4995",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4995"
          },
          {
            "name": "DSA-4996",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4996"
          },
          {
            "name": "FEDORA-2021-db6ebb2d68",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/"
          },
          {
            "name": "FEDORA-2021-131360fa9a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/"
          },
          {
            "name": "FEDORA-2021-483d896d1d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-07T02:06:16.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.webkit.org/show_bug.cgi?id=231479"
        },
        {
          "name": "[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/26/9"
        },
        {
          "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/27/1"
        },
        {
          "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/27/2"
        },
        {
          "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2021/10/27/4"
        },
        {
          "name": "DSA-4995",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4995"
        },
        {
          "name": "DSA-4996",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4996"
        },
        {
          "name": "FEDORA-2021-db6ebb2d68",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/"
        },
        {
          "name": "FEDORA-2021-131360fa9a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/"
        },
        {
          "name": "FEDORA-2021-483d896d1d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-42762",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q",
              "refsource": "MISC",
              "url": "https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q"
            },
            {
              "name": "https://bugs.webkit.org/show_bug.cgi?id=231479",
              "refsource": "MISC",
              "url": "https://bugs.webkit.org/show_bug.cgi?id=231479"
            },
            {
              "name": "[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/26/9"
            },
            {
              "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/27/1"
            },
            {
              "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/27/2"
            },
            {
              "name": "[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2021/10/27/4"
            },
            {
              "name": "DSA-4995",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4995"
            },
            {
              "name": "DSA-4996",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4996"
            },
            {
              "name": "FEDORA-2021-db6ebb2d68",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/"
            },
            {
              "name": "FEDORA-2021-131360fa9a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/"
            },
            {
              "name": "FEDORA-2021-483d896d1d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-42762",
    "datePublished": "2021-10-20T18:15:59.000Z",
    "dateReserved": "2021-10-20T00:00:00.000Z",
    "dateUpdated": "2024-08-04T03:38:50.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-5127-1

Vulnerability from osv_ubuntu

Published

2021-11-01 13:43

Modified

2026-04-22 07:37

Summary

webkit2gtk vulnerabilities

Details

A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

References

URL

Type

	https://ubuntu.com/security/notices/USN-5127-1	ADVISORY
	https://ubuntu.com/security/CVE-2021-30846	REPORT
	https://ubuntu.com/security/CVE-2021-30851	REPORT
	https://ubuntu.com/security/CVE-2021-42762	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-30846",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-30851",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-42762",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37-gtk2",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.34.1-0ubuntu0.20.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.34.1-0ubuntu0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.34.1-0ubuntu0.20.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26.1-3",
        "2.26.2-1",
        "2.26.3-1ubuntu2",
        "2.26.4-1ubuntu1",
        "2.28.0-1ubuntu2",
        "2.28.1-1",
        "2.28.2-0ubuntu0.20.04.1",
        "2.28.3-0ubuntu0.20.04.1",
        "2.28.4-0ubuntu0.20.04.1",
        "2.30.3-0ubuntu0.20.04.1",
        "2.30.5-0ubuntu0.20.04.1",
        "2.30.6-0ubuntu0.20.04.1",
        "2.32.0-0ubuntu0.20.04.1",
        "2.32.3-0ubuntu0.20.04.1",
        "2.32.4-0ubuntu0.20.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "A large number of security issues were discovered in the WebKitGTK Web and\nJavaScript engines. If a user were tricked into viewing a malicious\nwebsite, a remote attacker could exploit a variety of issues related to web\nbrowser security, including cross-site scripting attacks, denial of service\nattacks, and arbitrary code execution.\n",
  "id": "USN-5127-1",
  "modified": "2026-04-22T07:37:00Z",
  "published": "2021-11-01T13:43:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5127-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-30846"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-30851"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-42762"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "webkit2gtk vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-30846",
    "UBUNTU-CVE-2021-30851",
    "UBUNTU-CVE-2021-42762"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ubuntu-cve-2021-42762

Vulnerability from osv_ubuntu

CVE-2021-42762 (GCVE-0-2021-42762)

usn-5127-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour