{"api_version":"1","generated_at":"2026-04-22T19:36:26+00:00","cve":"CVE-2021-42762","urls":{"html":"https://cve.report/CVE-2021-42762","api":"https://cve.report/api/cve/CVE-2021-42762.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-42762","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-42762"},"summary":{"title":"CVE-2021-42762","description":"BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-10-20 19:15:00","updated_at":"2023-11-07 03:39:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/10/27/2","name":"[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","refsource":"MLIST","tags":[],"title":"oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://bugs.webkit.org/show_bug.cgi?id=231479","name":"https://bugs.webkit.org/show_bug.cgi?id=231479","refsource":"MISC","tags":[],"title":"231479 – [WPE][GTK] Limited sandbox escape via VFS syscalls","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/","name":"FEDORA-2021-131360fa9a","refsource":"","tags":[],"title":"[SECURITY] Fedora 33 Update: webkit2gtk3-2.34.1-1.fc33 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2021/dsa-4995","name":"DSA-4995","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-4995-1 webkit2gtk","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.openwall.com/lists/oss-security/2021/10/26/9","name":"[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","refsource":"MLIST","tags":[],"title":"oss-security - WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/","name":"FEDORA-2021-483d896d1d","refsource":"","tags":[],"title":"[SECURITY] Fedora 34 Update: webkit2gtk3-2.34.1-1.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/","name":"FEDORA-2021-db6ebb2d68","refsource":"","tags":[],"title":"[SECURITY] Fedora 35 Update: webkit2gtk3-2.34.1-2.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/","name":"FEDORA-2021-db6ebb2d68","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 35 Update: webkit2gtk3-2.34.1-2.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.openwall.com/lists/oss-security/2021/10/27/1","name":"[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","refsource":"MLIST","tags":[],"title":"oss-security - Re: WebKitGTK and WPE WebKit Security Advisory\n WSA-2021-0006","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/","name":"FEDORA-2021-131360fa9a","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 33 Update: webkit2gtk3-2.34.1-1.fc33 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.openwall.com/lists/oss-security/2021/10/27/4","name":"[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","refsource":"MLIST","tags":[],"title":"oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q","name":"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q","refsource":"MISC","tags":[],"title":"CVE-2021-41133: Sandbox bypass via recent VFS-manipulating syscalls · Advisory · flatpak/flatpak · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2021/dsa-4996","name":"DSA-4996","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-4996-1 wpewebkit","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/","name":"FEDORA-2021-483d896d1d","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 34 Update: webkit2gtk3-2.34.1-1.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42762","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42762","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"42762","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"42762","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"42762","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"33","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"42762","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"34","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"42762","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"42762","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"webkitgtk","cpe5":"webkitgtk","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"42762","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wpewebkit","cpe5":"wpe_webkit","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-42762","qid":"178857","title":"Debian Security Update for webkit2gtk (DSA 4995-1)"},{"cve":"CVE-2021-42762","qid":"178858","title":"Debian Security Update for wpewebkit (DSA 4996-1)"},{"cve":"CVE-2021-42762","qid":"183506","title":"Debian Security Update for webkit2gtkwpewebkit (CVE-2021-42762)"},{"cve":"CVE-2021-42762","qid":"198555","title":"Ubuntu Security Notification for WebKitGTK Vulnerabilities (USN-5127-1)"},{"cve":"CVE-2021-42762","qid":"282041","title":"Fedora Security Update for webkit2gtk3 (FEDORA-2021-483d896d1d)"},{"cve":"CVE-2021-42762","qid":"282042","title":"Fedora Security Update for webkit2gtk3 (FEDORA-2021-131360fa9a)"},{"cve":"CVE-2021-42762","qid":"296061","title":"Oracle Solaris 11.4 Support Repository Update (SRU) 42.113.1 Missing (CPUJAN2022)"},{"cve":"CVE-2021-42762","qid":"354436","title":"Amazon Linux Security Advisory for webkit2gtk3 : ALAS2022-2022-015"},{"cve":"CVE-2021-42762","qid":"355438","title":"Amazon Linux Security Advisory for webkitgtk4 : ALAS2-2023-2088"},{"cve":"CVE-2021-42762","qid":"502199","title":"Alpine Linux Security Update for webkit2gtk"},{"cve":"CVE-2021-42762","qid":"710570","title":"Gentoo Linux WebkitGTK+ Multiple Vulnerabilities (GLSA 202202-01)"},{"cve":"CVE-2021-42762","qid":"751325","title":"OpenSUSE Security Update for webkit2gtk3 (openSUSE-SU-2021:1454-1)"},{"cve":"CVE-2021-42762","qid":"751333","title":"OpenSUSE Security Update for webkit2gtk3 (openSUSE-SU-2021:3603-1)"},{"cve":"CVE-2021-42762","qid":"751392","title":"SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2021:3769-1)"},{"cve":"CVE-2021-42762","qid":"751394","title":"SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2021:3768-1)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2021-42762","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q","refsource":"MISC","name":"https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q"},{"url":"https://bugs.webkit.org/show_bug.cgi?id=231479","refsource":"MISC","name":"https://bugs.webkit.org/show_bug.cgi?id=231479"},{"refsource":"MLIST","name":"[oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","url":"http://www.openwall.com/lists/oss-security/2021/10/26/9"},{"refsource":"MLIST","name":"[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","url":"http://www.openwall.com/lists/oss-security/2021/10/27/1"},{"refsource":"MLIST","name":"[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","url":"http://www.openwall.com/lists/oss-security/2021/10/27/2"},{"refsource":"MLIST","name":"[oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006","url":"http://www.openwall.com/lists/oss-security/2021/10/27/4"},{"refsource":"DEBIAN","name":"DSA-4995","url":"https://www.debian.org/security/2021/dsa-4995"},{"refsource":"DEBIAN","name":"DSA-4996","url":"https://www.debian.org/security/2021/dsa-4996"},{"refsource":"FEDORA","name":"FEDORA-2021-db6ebb2d68","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/"},{"refsource":"FEDORA","name":"FEDORA-2021-131360fa9a","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/"},{"refsource":"FEDORA","name":"FEDORA-2021-483d896d1d","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/"}]}},"nvd":{"publishedDate":"2021-10-20 19:15:00","lastModifiedDate":"2023-11-07 03:39:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.8,"impactScore":3.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":4.6},"severity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*","versionEndExcluding":"2.34.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*","versionEndExcluding":"2.34.1","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"42762","Ordinal":"219269","Title":"CVE-2021-42762","CVE":"CVE-2021-42762","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"42762","Ordinal":"1","NoteData":"BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"42762","Ordinal":"2","NoteData":"2021-10-20","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"42762","Ordinal":"3","NoteData":"2021-11-06","Type":"Other","Title":"Modified"}]}}}