RHSA-2025:22790 — Red Hat Security Advisory: webkit2gtk3 security update

Fixed packages 9

Release	Package	Fixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-debuginfo	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-debugsource	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-devel	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-devel-debuginfo	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-jsc	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-jsc-debuginfo	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-jsc-devel	0:2.50.3-1.el9_7
Red Hat · RHEL 9 enterprise_linux:9::appstream	webkit2gtk3-jsc-devel-debuginfo	0:2.50.3-1.el9_7

Vulnerabilities 18

High 8.8

CVE-2025-43431

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
High 8.8

CVE-2025-43433

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
High 8.8

CVE-2025-66287

Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Red Hat The WebKitGTK Team Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

Dec 4, 2025
High 7.5

CVE-2025-13502

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

Red Hat The WebKitGTK Team Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

Nov 25, 2025
High 7.4

CVE-2025-13947 Public exploit

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations orig…

Red Hat The WebKitGTK Team Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

Dec 3, 2025
Medium 6.5

CVE-2025-43440

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Taho…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43392

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43421

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and …

Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43425

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, ma…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43427

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.…

Apple macOS iOS and iPadOS tvOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43429

A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadO…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43430

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43432

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and …

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43434

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 an…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43438

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 an…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43441

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

Apple macOS iOS and iPadOS tvOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43443

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025
Medium 4.3

CVE-2025-43458

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 1…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Nov 4, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416300
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416325
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416327
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416329
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416330
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416331
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416332
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416334
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416335
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416336
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416337
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416355
report
https://bugzilla.redhat.com/show_bug.cgi?id=2418576
report
https://bugzilla.redhat.com/show_bug.cgi?id=2418855
report
https://bugzilla.redhat.com/show_bug.cgi?id=2418857
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22790.json
report
https://access.redhat.com/security/cve/CVE-2025-13502
advisory
https://www.cve.org/CVERecord?id=CVE-2025-13502
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-13502
article
https://bugs.webkit.org/show_bug.cgi?id=302218
report
https://access.redhat.com/security/cve/CVE-2025-13947
advisory
https://www.cve.org/CVERecord?id=CVE-2025-13947
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-13947
article
https://bugs.webkit.org/show_bug.cgi?id=271957
report
https://access.redhat.com/security/cve/CVE-2025-43392
advisory
https://www.cve.org/CVERecord?id=CVE-2025-43392
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-43392
article
https://webkitgtk.org/security/WSA-2025-0008.html
report
https://access.redhat.com/security/cve/CVE-2025-43421
advisory
https://www.cve.org/CVERecord?id=CVE-2025-43421
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-43421
report
https://access.redhat.com/security/cve/CVE-2025-43425
advisory
https://www.cve.org/CVERecord?id=CVE-2025-43425
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-43425
report
https://access.redhat.com/security/cve/CVE-2025-43427
advisory
https://www.cve.org/CVERecord?id=CVE-2025-43427
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-43427
report
https://access.redhat.com/security/cve/CVE-2025-43429

Red Hat Security Advisory: webkit2gtk3 security update

Fixed packages 9

Vulnerabilities 18

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash

Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Taho…

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.…

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and …

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, ma…

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.…

A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadO…

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and …

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 an…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 an…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26…

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 1…

References