Skip to content
OpenAdvisories
High 2 exploited CVEs ALAS2-2025-3114 27 CVEs

Important: webkitgtk4 security update (Amazon Linux 2)

Published Jan 5, 2026 · Updated Mar 23, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-66287: A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. CVE-2025-43541: A flaw was found in WebKitGTK. Processing malicious web content can cause a type confusion issue due to improper state handling and result in an unexpected crash. CVE-2025-43536: A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash. CVE-2025-43535: A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. CVE-2025-43531: A flaw was found in WebKitGTK. Processing malicious web content can cause a race condition due to improper state handling and result in an unexpected process crash. CVE-2025-43529: A flaw was found in webkitgtk where when processing a maliciously crafted web content a use-after-free type of weaknesses may be triggered leading to a remote code execution in the client machine. CVE-2025-43501: A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper memory handling and result in an unexpected process crash. CVE-2025-43458: This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43443: This issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43441: The issue was addressed with improved memory handling. This issue is fixed in tvOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43440: This issue was addressed with improved checks This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43438: A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-43434: A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-43433: The issue was addressed with improved memory handling. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Processing maliciously crafted web content may lead to memory corruption. CVE-2025-43432: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43431: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to memory corruption. CVE-2025-43430: This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43429: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43427: This issue was addressed through improved state management. This issue is fixed in iOS 26.1 and iPadOS 26.1, tvOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43425: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43421: Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43419: The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to memory corruption. CVE-2025-43392: The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. A website may exfiltrate image data cross-origin. CVE-2025-31277: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing maliciously crafted web content may lead to memory corruption. CVE-2025-31223: The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption. CVE-2025-13947: A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify t

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 webkitgtk4 0:2.50.4-1.amzn2
Amazon Linux · 2 webkitgtk4-devel 0:2.50.4-1.amzn2
Amazon Linux · 2 webkitgtk4-jsc 0:2.50.4-1.amzn2
Amazon Linux · 2 webkitgtk4-jsc-devel 0:2.50.4-1.amzn2

Vulnerabilities 27

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-13502.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-13947.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-31223.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-31277.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43392.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43419.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43421.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43425.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43427.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43429.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43430.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43431.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43432.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43433.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43434.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43438.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43440.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43441.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43443.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43458.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43501.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43529.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43531.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43535.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43536.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43541.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-66287.html