ALSA-2026:42088 — Important: webkit2gtk3 security update

Summary

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699)
* webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701)
* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712)
* webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713)
* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720)
* webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721)
* webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43725)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43726)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43727)
* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731)
* webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information (CVE-2026-43732)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43734)
* webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43742)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

Release	Package	Fixed in
AlmaLinux · 8	webkit2gtk3	2.52.5-1.el8_10
AlmaLinux · 8	webkit2gtk3-devel	2.52.5-1.el8_10
AlmaLinux · 8	webkit2gtk3-jsc	2.52.5-1.el8_10
AlmaLinux · 8	webkit2gtk3-jsc-devel	2.52.5-1.el8_10

Vulnerabilities 24

High 8.8

CVE-2026-43705

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 8.8

CVE-2026-43715

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 …

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 8.8

CVE-2026-43731

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 7.1

CVE-2026-43701

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 7.1

CVE-2026-43725

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-39872

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43663

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43676

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43699

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43707

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43712

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43713

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iP…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43716

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43720

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43721

This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43726

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43727

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43732

A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPad…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43734

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43740

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43742

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43745

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-64787

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Aug 17, 2026
Medium 5.6

CVE-2024-4367 Public exploit EPSS 71%

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm

May 14, 2024

References

report
https://access.redhat.com/security/cve/CVE-2024-4367
report
https://access.redhat.com/security/cve/CVE-2026-39872
report
https://access.redhat.com/security/cve/CVE-2026-43663
report
https://access.redhat.com/security/cve/CVE-2026-43676
report
https://access.redhat.com/security/cve/CVE-2026-43699
report
https://access.redhat.com/security/cve/CVE-2026-43701
report
https://access.redhat.com/security/cve/CVE-2026-43705
report
https://access.redhat.com/security/cve/CVE-2026-43707
report
https://access.redhat.com/security/cve/CVE-2026-43712
report
https://access.redhat.com/security/cve/CVE-2026-43713
report
https://access.redhat.com/security/cve/CVE-2026-43715
report
https://access.redhat.com/security/cve/CVE-2026-43716
report
https://access.redhat.com/security/cve/CVE-2026-43720
report
https://access.redhat.com/security/cve/CVE-2026-43721
report
https://access.redhat.com/security/cve/CVE-2026-43725
report
https://access.redhat.com/security/cve/CVE-2026-43726
report
https://access.redhat.com/security/cve/CVE-2026-43727
report
https://access.redhat.com/security/cve/CVE-2026-43731
report
https://access.redhat.com/security/cve/CVE-2026-43732
report
https://access.redhat.com/security/cve/CVE-2026-43734
report
https://access.redhat.com/security/cve/CVE-2026-43740
report
https://access.redhat.com/security/cve/CVE-2026-43742
report
https://access.redhat.com/security/cve/CVE-2026-43745
report
https://bugzilla.redhat.com/2280382
report
https://bugzilla.redhat.com/2500519
report
https://bugzilla.redhat.com/2500520
report
https://bugzilla.redhat.com/2500521
report
https://bugzilla.redhat.com/2500522
report
https://bugzilla.redhat.com/2500523
report
https://bugzilla.redhat.com/2500524
report
https://bugzilla.redhat.com/2500525
report
https://bugzilla.redhat.com/2500526
report
https://bugzilla.redhat.com/2500527
report
https://bugzilla.redhat.com/2500528
report
https://bugzilla.redhat.com/2500529
report
https://bugzilla.redhat.com/2500530
report
https://bugzilla.redhat.com/2500531
report
https://bugzilla.redhat.com/2500532
report
https://bugzilla.redhat.com/2500533

Important: webkit2gtk3 security update

Summary

Fixed packages 4

Vulnerabilities 24

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 …

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS…

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iP…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPad…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10…

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

References