Vulnerability Name:

CVE-2021-21806 (CCN-205101)

Assigned:2021-06-02
Published:2021-06-02
Updated:2022-10-06
Summary:An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in remote code execution. The victim needs to visit a malicious web site to trigger the vulnerability.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-416
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-21806

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20210723 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0004

Source: XF
Type: UNKNOWN
webkit-cve202121806-code-exec(205101)

Source: CCN
Type: Talos Vulnerability Report TALOS-2021-1214
Webkit fireEventListeners use-after-free vulnerability

Source: MISC
Type: Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1214

Source: CCN
Type: WebKit Web site
WebKit WebKitGTK

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Vulnerable Configuration:Configuration 1:
  • cpe:/a:webkitgtk:webkitgtk:2.30.3:*:*:*:*:*:x64:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8033
    P
    		libjavascriptcoregtk-5_0-0-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:7603
    P
    		libjavascriptcoregtk-4_0-18-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:7941
    P
    		libjavascriptcoregtk-4_1-0-2.38.6-150400.4.39.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:51967
    P
    		Security update for supportutils (Moderate)
    2022-11-29
    oval:org.opensuse.security:def:786
    P
    		Security update for slurm_18_08 (Important)
    2022-09-29
    oval:org.opensuse.security:def:95404
    P
    		Security update for xen (Important)
    2022-07-29
    oval:org.opensuse.security:def:3018
    P
    		augeas-1.10.1-2.6 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3320
    P
    		pam_yubico-2.26-1.25 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3401
    P
    		xen-4.12.1_06-1.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3498
    P
    		ghostscript-9.27-23.28.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3687
    P
    		libthai-data-0.1.25-4.2 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94610
    P
    		libXfont2-2-2.0.3-1.17 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94950
    P
    		libjavascriptcoregtk-4_1-0-2.36.0-150400.2.13 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94804
    P
    		python3-paramiko-2.4.2-150100.6.12.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95031
    P
    		libjavascriptcoregtk-5_0-0-2.36.0-150400.2.12 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94648
    P
    		libjavascriptcoregtk-4_0-18-2.36.0-150400.2.13 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:6196
    P
    		Security update for openssl-1_0_0 (Important)
    2022-03-15
    oval:org.opensuse.security:def:99742
    P
    		 (Critical)
    2022-02-08
    oval:org.opensuse.security:def:112660
    P
    		libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media (Moderate)
    2022-01-17
    oval:com.redhat.rhsa:def:20214381
    P
    		RHSA-2021:4381: GNOME security, bug fix, and enhancement update (Moderate)
    2021-11-09
    oval:org.opensuse.security:def:102117
    P
    		Security update for the Linux Kernel (Important)
    2021-11-09
    oval:org.opensuse.security:def:111090
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-18
    oval:org.opensuse.security:def:99149
    P
    		 (Important)
    2021-10-15
    oval:org.opensuse.security:def:76353
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:117503
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:67285
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:107989
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:74316
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:101728
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:4159
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:65248
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:117697
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:101323
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:108183
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:74381
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:4224
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:65313
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:73709
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:101517
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:64587
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:108783
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:76013
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:1037
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:5856
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:66945
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:73898
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:111744
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:64776
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-12
    oval:org.opensuse.security:def:31690
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:57513
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:86662
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:23684
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:82638
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:33983
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:59806
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:89203
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:30134
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:55957
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:84678
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:127176
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:32198
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:58021
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:87482
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:23979
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:51672
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:83341
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:34555
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:60378
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:89461
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:30254
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:56077
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:85746
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:33018
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:58841
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:88200
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:26141
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:83461
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:125612
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:31282
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:57105
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:86154
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:5128
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:33725
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:59548
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:88517
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:29431
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:55254
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:84219
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:126779
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:106034
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:10157
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:92199
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:100053
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:9403
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:70297
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:99344
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:106233
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:10344
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:92394
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:8656
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:69543
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:105644
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:9594
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:70484
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:99543
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:106432
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:92593
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:8843
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:69734
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:98954
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:105839
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:9793
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:92004
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:106718
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:92792
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:9038
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:69933
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-04
    oval:org.opensuse.security:def:106141
    P
    		libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media (Moderate)
    2021-10-01
    BACK
    webkitgtk webkitgtk 2.30.3
    ibm cloud pak for security 1.7.2.0