CVE-2021-42762
- State
- Published
- Severity
- Not scored
- Published
- Oct 20, 2021
- Updated
- Aug 4, 2024
- Reserved
- Oct 20, 2021
Description
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
- https://bugs.webkit.org/show_bug.cgi?id=231479
- [oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006mailing-list
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006mailing-list
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006mailing-list
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006mailing-list
- DSA-4995vendor-advisory
- DSA-4996vendor-advisory
- FEDORA-2021-db6ebb2d68vendor-advisory
- FEDORA-2021-131360fa9avendor-advisory
- FEDORA-2021-483d896d1dvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.