Red Hat Security Advisory: webkitgtk4 security update

Fixed packages 6

Vulnerabilities 18

• High 8.8
  CVE-2025-43431

  The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• High 8.8
  CVE-2025-43433

  The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• High 8.8
  CVE-2025-66287

  Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash

  A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

  Red Hat The WebKitGTK Team Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu
  Dec 4, 2025
• High 7.5
  CVE-2025-13502

  Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos

  A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

  Red Hat The WebKitGTK Team Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu
  Nov 25, 2025
• High 7.4
  CVE-2025-13947 Public exploit

  Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

  A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations orig…

  Red Hat The WebKitGTK Team Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu
  Dec 3, 2025
• Medium 6.5
  CVE-2025-43440

  This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Taho…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43392

  The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43421

  Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and …

  Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43425

  The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, ma…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43427

  This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.…

  Apple macOS iOS and iPadOS tvOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43429

  A buffer overflow was addressed with improved bounds checking. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadO…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43430

  This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43432

  A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and …

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43434

  A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 an…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43438

  A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 an…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43441

  The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2…

  Apple macOS iOS and iPadOS tvOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43443

  This issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025
• Medium 4.3
  CVE-2025-43458

  This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 1…

  Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
  Nov 4, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416300
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416327
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416335
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416337
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416355
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418855
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418857
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23583.json
• report
  https://access.redhat.com/security/cve/CVE-2025-13502
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13502
• article
  https://bugs.webkit.org/show_bug.cgi?id=302218
• report
  https://access.redhat.com/security/cve/CVE-2025-13947
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-13947
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-13947
• article
  https://bugs.webkit.org/show_bug.cgi?id=271957
• report
  https://access.redhat.com/security/cve/CVE-2025-43392
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-43392
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-43392
• article
  https://webkitgtk.org/security/WSA-2025-0008.html
• report
  https://access.redhat.com/security/cve/CVE-2025-43421
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-43421
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-43421
• report
  https://access.redhat.com/security/cve/CVE-2025-43425
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-43425
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-43425
• report
  https://access.redhat.com/security/cve/CVE-2025-43427
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-43427
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-43427
• report
  https://access.redhat.com/security/cve/CVE-2025-43429