Skip to content
OpenAdvisories
High 2 exploited CVEs ALAS2-2025-2869 39 CVEs

Important: webkitgtk4 security update (Amazon Linux 2)

Published May 21, 2025 · Updated Mar 23, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-43480: The issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A malicious website may exfiltrate data cross-origin. CVE-2025-30427: A use-after-free issue was addressed with improved memory management. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-24264: The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-24216: The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-24209: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-24208: A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack. CVE-2025-24201: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.). CVE-2025-24162: This issue was addressed through improved state management. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-24158: The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing web content may lead to a denial-of-service. CVE-2025-24150: A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Copying a URL from Web Inspector may lead to command injection. CVE-2025-24143: The issue was addressed with improved access restrictions to the file system. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. A maliciously crafted webpage may be able to fingerprint the user. CVE-2024-54658: The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, macOS Sonoma 14.4. Processing web content may lead to a denial-of-service. CVE-2024-54551: The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.6, tvOS 17.6, Safari 17.6, macOS Sonoma 14.6, visionOS 1.3, iOS 17.6 and iPadOS 17.6. Processing web content may lead to a denial-of-service. CVE-2024-54543: The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.2, tvOS 18.2, Safari 18.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. Processing maliciously crafted web content may lead to memory corruption. CVE-2024-54534: The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption. CVE-2024-54508: The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2024-54505: A type confusion issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption. CVE-2024-54502: The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2024-54479: The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2024-44309: A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. CVE-2024-44296: The issue was addressed with improved checks. This issue is fixed in tvOS 18.1, iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, watchOS 11.1, visionOS 2.1, macOS Sequoia 15.1, Safari 18.1. Processing maliciously cr

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 webkitgtk4 0:2.46.6-1.amzn2.0.2
Amazon Linux · 2 webkitgtk4-debuginfo 0:2.46.6-1.amzn2.0.2
Amazon Linux · 2 webkitgtk4-devel 0:2.46.6-1.amzn2.0.2
Amazon Linux · 2 webkitgtk4-jsc 0:2.46.6-1.amzn2.0.2
Amazon Linux · 2 webkitgtk4-jsc-devel 0:2.46.6-1.amzn2.0.2

Vulnerabilities 39

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-43010.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23254.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23271.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27808.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27820.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27830.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27833.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27838.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27850.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27851.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-27856.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-40782.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-40857.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-40866.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44185.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44187.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44192.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44244.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44296.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-44309.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54479.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54502.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54505.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54508.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54534.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54543.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54551.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-54658.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-24143.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-24150.html