CVE-2021-42762

Katalog CVE

CVSS 5.3 · Medium EPSS 0,54%

Kerentanan pada webkitgtk, wpewebkit wpe webkit +2 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

Rincian

Terbit di NVD

20 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.webkit.org/show_bug.cgi?id=231479 exploit · issue tracking · advisory vendor
• http://www.openwall.com/lists/oss-security/2021/10/26/9 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/27/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/27/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/27/4 mailing list · advisory pihak ketiga
• https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4995 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4996 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHW...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53D...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAG...