CVE-2021-42762

Name
CVE-2021-42762
Description
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://bugs.webkit.org/show_bug.cgi?id=231479
MISC https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
MLIST http://www.openwall.com/lists/oss-security/2021/10/26/9
MLIST http://www.openwall.com/lists/oss-security/2021/10/27/1
MLIST http://www.openwall.com/lists/oss-security/2021/10/27/2
MLIST http://www.openwall.com/lists/oss-security/2021/10/27/4
DEBIAN https://www.debian.org/security/2021/dsa-4996
DEBIAN https://www.debian.org/security/2021/dsa-4995
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:* webkitgtk >= None < 2.34.1
cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:* wpe_webkit >= None < 2.34.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status