Arch Linux Security Advisory ASA-202110-9
========================================
Severity: Medium
Date    : 2021-10-29
CVE-ID  : CVE-2021-30846 CVE-2021-30851 CVE-2021-42762
Package : webkit2gtk
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2483

Summary
======
The package webkit2gtk before version 2.34.1-1 is vulnerable to
multiple issues including arbitrary code execution and sandbox escape.

Resolution
=========
Upgrade to 2.34.1-1.

# pacman -Syu "webkit2gtk>=2.34.1-1"

The problems have been fixed upstream in version 2.34.1.

Workaround
=========
None.

Description
==========
- CVE-2021-30846 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.34.0. Processing maliciously crafted web content may lead to
arbitrary code execution.

- CVE-2021-30851 (arbitrary code execution)

A security issue has been found in WebKitGTK and WPE WebKit before
2.34.0. Processing maliciously crafted web content may lead to
arbitrary code execution.

- CVE-2021-42762 (sandbox escape)

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows
a limited sandbox bypass that allows a sandboxed process to trick host
processes into thinking the sandboxed process is not confined by the
sandbox, by abusing VFS syscalls that manipulate its filesystem
namespace. The impact is limited to host services that create UNIX
sockets that WebKit mounts inside its sandbox, and the sandboxed
process remains otherwise confined. NOTE: this is similar to
CVE-2021-41133.

Impact
=====
A remote attacker could execute arbitrary code or escape the
confinements of the security sandbox through crafted web content.

References
=========
https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30846
https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30851
https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-42762
https://bugs.webkit.org/show_bug.cgi?id=231479
https://trac.webkit.org/changeset/284451/webkit
https://security.archlinux.org/CVE-2021-30846
https://security.archlinux.org/CVE-2021-30851
https://security.archlinux.org/CVE-2021-42762

ArchLinux: 202110-9: webkit2gtk: multiple issues

November 1, 2021

Summary

- CVE-2021-30846 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2021-30851 (arbitrary code execution)
A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution.
- CVE-2021-42762 (sandbox escape)
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

Resolution

Upgrade to 2.34.1-1. # pacman -Syu "webkit2gtk>=2.34.1-1"
The problems have been fixed upstream in version 2.34.1.

References

https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30846 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30851 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-42762 https://bugs.webkit.org/show_bug.cgi?id=231479 https://trac.webkit.org/changeset/284451/webkit https://security.archlinux.org/CVE-2021-30846 https://security.archlinux.org/CVE-2021-30851 https://security.archlinux.org/CVE-2021-42762

Severity
Package : webkit2gtk
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2483

Workaround

None.

Related News

23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved