Authentication flaw

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact...

CVE-2021-42762

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact...

CVE-2021-42762

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact...

CVE-2021-42762

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact...

CVE-2021-42762

CVE-2021-42762 affects WebKitGTK and WPE WebKit up to version 2.34.0 (fixed in 2.34.1). BubblewrapLauncher.cpp can enable a limited sandbox bypass, allowing a sandboxed process to trick host processes into thinking it is not confined by the sandbox by abusing VFS syscalls that manipulate the file...

CVE-2021-42762

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact...

PT-2021-8067 · Webkitgtk +7 · Webkitgtk +7

Name of the Vulnerable Software and Affected Versions: WebKitGTK versions prior to 2.34.1 WPE WebKit versions prior to 2.34.1 Description: The issue is related to insecure privilege management in WebKitGTK and WPE WebKit, allowing a remote attacker to impact the integrity of protected information...

CVE-2021-30849

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution...

[SECURITY] Fedora 34 Update: chromium-94.0.4606.81-1.fc34

Chromium is an open-source web browser, powered by WebKit Blink...

PT-2021-4740 · Apple · Webkit +1

Name of the Vulnerable Software and Affected Versions: Mac OS affected versions not specified Description: The issue is related to a module for displaying web pages in WebKit, which is part of the Mac OS operating system family. It involves the possibility of concurrent execution using a shared...

The vulnerability of the WebKit component of the iOS operating system allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the WebKit component of the iOS operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure by using a specially crafted website...

[SECURITY] Fedora 33 Update: chromium-94.0.4606.61-1.fc33

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 34 Update: chromium-94.0.4606.61-1.fc34

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 35 Update: chromium-93.0.4577.63-1.fc35

Chromium is an open-source web browser, powered by WebKit Blink...

Apple Patches 3 More Zero-Days Under Active Attack

Apple has patched three actively exploited zero-day security vulnerabilities in updates to iOS and macOS, one of which can allow an attacker to execute arbitrary code with kernel privileges. Apple released two updates on Thursday: iOS 12.5.5, which patches three zero-days that affect older versio...

Urgent Apple iOS and macOS Updates Released to Fix Actively Exploited Zero-Days

Apple on Thursday released security updates to fix multiple security vulnerabilities in older versions of iOS and macOS that it says have been detected in exploits in the wild, in addition to expanding patches for a previously plugged security weakness abused by NSO Group's Pegasus surveillance...

About the security content of iOS 12.5.5

About the security content of iOS 12.5.5 This document describes the security content of iOS 12.5.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Apple Safari Security Update (HT212816)

The host is missing an important security update according to Apple. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:safari...

Detect & Prioritize NSO Pegasus iPhone Spyware Vulnerabilities Using VMDR for Mobile Devices

Apple recently released iOS and iPadOS 14.8 as a security update that addresses 2 critical zero-day vulnerabilities, which are used to deploy NSO Pegasus iPhone spyware. Qualys recommends that security teams should immediately update all devices running iOS and iPadOS to the latest version. "Appl...

KLA12293 Multiple vulnerabilities in Apple iTunes

Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A code execution vulnerability in ImageIO can be exploited via special crafted image to...