Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-83596: A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. CVE-2026-78376: A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. CVE-2026-65341: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption. CVE-2026-65340: This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-65338: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-65337: This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-65336: This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-65335: This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-65334: A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-65333: This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-65331: This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-64784: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-64780: The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-64779: A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-64715: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | webkitgtk4 | 0:2.52.6-1.amzn2.0.2 |
| Amazon Linux · 2 | webkitgtk4-devel | 0:2.52.6-1.amzn2.0.2 |
| Amazon Linux · 2 | webkitgtk4-jsc | 0:2.52.6-1.amzn2.0.2 |
| Amazon Linux · 2 | webkitgtk4-jsc-devel | 0:2.52.6-1.amzn2.0.2 |
Vulnerabilities 15
-
High 8.8
Webkitgtk: use-after-free of jscvalue function parameters
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
-
High 8.8
Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10…
-
Medium 5.4
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.…
-
Medium 4.3
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS…
-
Medium 4.3
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Low 3.1
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.1…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64715.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64779.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64780.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-64784.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65331.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65333.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65334.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65335.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65336.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65337.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65338.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65340.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-65341.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-78376.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-83596.html