RHSA-2026:57348 — Red Hat Security Advisory: webkit2gtk3 security update

Fixed packages 18

Release	Package	Fixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-debuginfo	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-debugsource	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-devel	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-devel-debuginfo	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-jsc	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-jsc-debuginfo	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-jsc-devel	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	webkit2gtk3-jsc-devel-debuginfo	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-debuginfo	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-debugsource	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-devel	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-devel-debuginfo	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-jsc	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-jsc-debuginfo	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-jsc-devel	0:2.52.5-1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream	webkit2gtk3-jsc-devel-debuginfo	0:2.52.5-1.el8_4

Vulnerabilities 24

High 8.8

CVE-2026-43705

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 8.8

CVE-2026-43715

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 …

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 8.8

CVE-2026-43731

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 7.1

CVE-2026-43701

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
High 7.1

CVE-2026-43725

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-39872

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43663

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43676

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43699

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43707

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43712

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43713

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iP…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43716

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43720

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43721

This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43726

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43727

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43732

A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPad…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43734

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43740

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43742

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-43745

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Jun 29, 2026
Medium 6.5

CVE-2026-64787

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Aug 17, 2026
Medium 5.6

CVE-2024-4367 Public exploit EPSS 71%

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm

May 14, 2024

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2280382
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500519
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500520
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500521
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500522
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500523
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500524
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500525
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500526
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500527
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500528
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500529
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500530
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500531
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500532
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500533
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500534
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500535
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500536
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500537
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500538
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500539
report
https://bugzilla.redhat.com/show_bug.cgi?id=2500540
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57348.json
report
https://access.redhat.com/security/cve/CVE-2024-4367
advisory
https://www.cve.org/CVERecord?id=CVE-2024-4367
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4367
article
https://webkitgtk.org/security/WSA-2026-0004.html
article
https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/#CVE-2024-4367
article
https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/#CVE-2024-4367
report
https://access.redhat.com/security/cve/CVE-2026-39872
advisory
https://www.cve.org/CVERecord?id=CVE-2026-39872
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39872
article
https://bugs.webkit.org/show_bug.cgi?id=313528
report
https://access.redhat.com/security/cve/CVE-2026-43663
advisory
https://www.cve.org/CVERecord?id=CVE-2026-43663
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-43663
article
https://bugs.webkit.org/show_bug.cgi?id=312781

Red Hat Security Advisory: webkit2gtk3 security update

Fixed packages 18

Vulnerabilities 24

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 …

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS…

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.…

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iP…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPad…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10…

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18…

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10…

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

References