CVE Vulnerabilities

CVE-2021-21775

Use After Free

Published: Jul 07, 2021 | Modified: Nov 21, 2024
CVSS 3.x
8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
6 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
8.8 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Webkitgtk Webkitgtk 2.30.4 (including) 2.30.4 (including)
Red Hat Enterprise Linux 7 Extended Lifecycle Support RedHat webkitgtk4-0:2.48.3-2.el7_9 *
Red Hat Enterprise Linux 8 RedHat webkit2gtk3-0:2.32.3-2.el8 *
Qtwebkit-opensource-src Ubuntu bionic *
Qtwebkit-opensource-src Ubuntu devel *
Qtwebkit-opensource-src Ubuntu esm-apps/bionic *
Qtwebkit-opensource-src Ubuntu esm-apps/focal *
Qtwebkit-opensource-src Ubuntu esm-apps/jammy *
Qtwebkit-opensource-src Ubuntu esm-apps/noble *
Qtwebkit-opensource-src Ubuntu esm-infra/xenial *
Qtwebkit-opensource-src Ubuntu focal *
Qtwebkit-opensource-src Ubuntu groovy *
Qtwebkit-opensource-src Ubuntu hirsute *
Qtwebkit-opensource-src Ubuntu impish *
Qtwebkit-opensource-src Ubuntu jammy *
Qtwebkit-opensource-src Ubuntu kinetic *
Qtwebkit-opensource-src Ubuntu lunar *
Qtwebkit-opensource-src Ubuntu mantic *
Qtwebkit-opensource-src Ubuntu noble *
Qtwebkit-opensource-src Ubuntu trusty *
Qtwebkit-opensource-src Ubuntu upstream *
Qtwebkit-opensource-src Ubuntu xenial *
Qtwebkit-source Ubuntu bionic *
Qtwebkit-source Ubuntu esm-apps/bionic *
Qtwebkit-source Ubuntu esm-apps/xenial *
Qtwebkit-source Ubuntu trusty *
Qtwebkit-source Ubuntu xenial *
Webkit2gtk Ubuntu bionic *
Webkit2gtk Ubuntu devel *
Webkit2gtk Ubuntu esm-infra/bionic *
Webkit2gtk Ubuntu esm-infra/focal *
Webkit2gtk Ubuntu esm-infra/xenial *
Webkit2gtk Ubuntu focal *
Webkit2gtk Ubuntu groovy *
Webkit2gtk Ubuntu hirsute *
Webkit2gtk Ubuntu impish *
Webkit2gtk Ubuntu jammy *
Webkit2gtk Ubuntu kinetic *
Webkit2gtk Ubuntu lunar *
Webkit2gtk Ubuntu mantic *
Webkit2gtk Ubuntu noble *
Webkit2gtk Ubuntu upstream *
Webkit2gtk Ubuntu xenial *
Webkitgtk Ubuntu bionic *
Webkitgtk Ubuntu esm-apps/bionic *
Webkitgtk Ubuntu esm-apps/xenial *
Webkitgtk Ubuntu trusty *
Webkitgtk Ubuntu xenial *
Wpewebkit Ubuntu esm-apps/focal *
Wpewebkit Ubuntu esm-apps/jammy *
Wpewebkit Ubuntu focal *
Wpewebkit Ubuntu groovy *
Wpewebkit Ubuntu hirsute *
Wpewebkit Ubuntu impish *
Wpewebkit Ubuntu jammy *
Wpewebkit Ubuntu trusty *

Potential Mitigations

References