Description
A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Webkit | Webkit WebKitGTK 2.30.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wpewebkit +1 | 2.30.3-1 | — |
| Debian 13 | wpewebkit +1 | 2.30.3-1 | — |
| Debian 12 | wpewebkit +1 | 2.30.3-1 | — |
| Debian 10 | webkit2gtk | 2.30.3-1~deb10u1 | DSA-4797-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | qtwebkit-opensource-src | No fix yet | — |
| Ubuntu 22.04 LTS | wpewebkit +1 | No fix yet | — |
| Ubuntu 20.04 LTS | webkit2gtk | 2.30.3-0ubuntu0.20.04.1 | — |
| Ubuntu 20.04 LTS | wpewebkit +1 | No fix yet | — |
| Ubuntu 18.04 LTS | webkit2gtk | 2.30.3-0ubuntu0.18.04.1 | — |
| Ubuntu 18.04 LTS | webkitgtk +2 | No fix yet | — |
| Ubuntu 16.04 LTS | webkitgtk +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | gdm | 1:3.28.3-39.el8 | RHSA-2021:1586 |
| RHEL 8 | glib2 +5 | 2.56.4-9.el8 | RHSA-2021:1586 |
| RHEL 8 | webkit2gtk3 +3 | 2.30.4-1.el8 | RHSA-2021:1586 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 ELS | webkitgtk4 +4 | 2.48.3-2.el7_9 | RHSA-2025:10364 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | OpenEXR-libs +1 | 2.2.0-12.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | accountsservice-devel | 0.6.55-1.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | atkmm +2 | 2.24.2-7.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | cairomm +2 | 1.12.0-8.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | chrome-gnome-shell | 10.1-7.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | dleyna-core +1 | 0.6.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | enchant2 +1 | 2.2.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gamin +1 | 0.1.10-32.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | geoclue2 +3 | 2.5.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | geocode-glib +1 | 3.26.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gjs +1 | 1.56.2-5.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | glib2-doc +1 | 2.56.4-9.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | glibmm24 +2 | 2.56.0-2.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gnome-boxes | 3.36.5-8.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gnome-photos +1 | 3.28.1-4.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gnome-terminal +1 | 3.28.3-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gtk-doc | 1.28-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gtk2 +4 | 2.24.32-5.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gtkmm24 +2 | 2.24.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gtkmm30 +2 | 3.22.2-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | gvfs +10 | 1.36.2-11.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | libdazzle +1 | 3.28.5-2.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | libepubgen +1 | 0.1.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | libsass +1 | 3.4.5-6.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | libsigc++20 +2 | 2.10.0-6.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | libvisual +1 | 1:0.4.0-25.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | mutter-devel | 3.32.2-57.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | nautilus +2 | 3.28.1-15.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | pangomm +2 | 2.40.1-6.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | soundtouch +1 | 2.0.0-3.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | vala +1 | 0.40.19-2.el8 | ALSA-2021:1586 |
| AlmaLinux 8 | woff2 +1 | 1.0.2-5.el8 | ALSA-2021:1586 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | OpenEXR | 2.2.0-12.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | accountsservice | 0.6.55-1.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | atkmm | 2.24.2-7.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | cairomm | 1.12.0-8.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | chrome-gnome-shell | 10.1-7.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | dleyna-core +1 | 0.6.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | enchant2 | 2.2.3-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gamin | 0.1.10-32.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gdm | 1:3.28.3-39.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | geoclue2 | 2.5.5-2.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | geocode-glib | 3.26.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gjs | 1.56.2-5.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | glibmm24 | 2.56.0-2.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-boxes | 3.36.5-8.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-control-center | 3.28.2-27.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-online-accounts | 3.28.2-2.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-photos | 3.28.1-4.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-settings-daemon | 3.32.0-14.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-shell | 3.32.2-30.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-software | 3.36.1-5.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gnome-terminal | 3.28.3-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gtk-doc | 1.28-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gtk2 | 2.24.32-5.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gtkmm24 | 2.24.5-6.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gtkmm30 | 3.22.2-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | gvfs | 1.36.2-11.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | libdazzle | 3.28.5-2.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | libepubgen | 0.1.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | libsass | 3.4.5-6.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | libsigc++20 | 2.10.0-6.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | libvisual | 1:0.4.0-25.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | mutter | 3.32.2-57.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | nautilus | 3.28.1-15.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | pangomm | 2.40.1-6.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | soundtouch | 2.0.0-3.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | vala | 0.40.19-2.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | webkit2gtk3 | 2.30.4-1.el8 | RLSA-2021:1586 |
| Rocky Linux 8 | woff2 | 1.0.2-5.el8 | RLSA-2021:1586 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | webkit2gtk3 | 2.30.3-3.9.3 | SUSE-SU-2020:3867-1 |
| SLES 15 SP1 | webkit2gtk3 | 2.30.3-3.63.2 | SUSE-SU-2020:3864-1 |
| SLES 15 | webkit2gtk3 | 2.30.3-3.63.2 | SUSE-SU-2020:3864-1 |
| SLES 12 SP5 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SLES 12 SP4 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SLES 12 SP2 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SLES for SAP 15 | webkit2gtk3 | 2.30.3-3.63.2 | SUSE-SU-2020:3864-1 |
| SLES for SAP 12 SP5 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SLES for SAP 12 SP4 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SLES for SAP 12 SP3 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SLE HPC 15 | webkit2gtk3 | 2.30.3-3.63.2 | SUSE-SU-2020:3864-1 |
| SUSE OpenStack Cloud Crowbar 9 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SUSE OpenStack Cloud Crowbar 8 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SUSE OpenStack Cloud 9 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SUSE OpenStack Cloud 8 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
| SUSE HPE Helion OpenStack 8 | webkit2gtk3 | 2.32.1-2.63.3 | SUSE-SU-2021:1990-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | webkit2gtk3 | 2.30.3-lp152.2.7.3 | openSUSE-SU-2020:2310-1 |
| openSUSE Leap 15.1 | webkit2gtk3 | 2.30.3-lp151.2.28.2 | openSUSE-SU-2020:2304-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.20 | webkit2gtk | 2.30.3-r0 | — |
| Alpine v3.19 | webkit2gtk | 2.30.3-r0 | — |
| Alpine v3.18 | webkit2gtk | 2.30.3-r0 | — |
| Alpine v3.17 | webkit2gtk | 2.30.3-r0 | — |
| Alpine v3.16 | webkit2gtk | 2.30.3-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | webkit2gtk | 2.30.3-r0 | — |
| Alpine v3.14 | webkit2gtk | 2.30.3-r0 | — |
| Alpine v3.13 | webkit2gtk | 2.30.3-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | OpenEXR-libs +1 | 2.2.0-12.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | accountsservice +2 | 0.6.55-1.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | atkmm +2 | 2.24.2-7.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | cairomm +2 | 1.12.0-8.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | chrome-gnome-shell | 10.1-7.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | dleyna-core +1 | 0.6.0-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | enchant2 +1 | 2.2.3-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gamin +1 | 0.1.10-32.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gdm | 1:3.28.3-39.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | geoclue2 +3 | 2.5.5-2.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | geocode-glib +1 | 3.26.0-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gjs +1 | 1.56.2-5.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | glib2 +5 | 2.56.4-9.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | glibmm24 +2 | 2.56.0-2.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-boxes | 3.36.5-8.0.1.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-classic-session +22 | 3.32.1-14.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-control-center +1 | 3.28.2-27.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-online-accounts +1 | 3.28.2-2.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-photos +1 | 3.28.1-4.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-settings-daemon | 3.32.0-14.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-shell | 3.32.2-30.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-software | 3.36.1-5.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gnome-terminal +1 | 3.28.3-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gtk-doc | 1.28-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gtk2 +4 | 2.24.32-5.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gtkmm24 +2 | 2.24.5-6.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gtkmm30 +2 | 3.22.2-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | gvfs +10 | 1.36.2-11.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | libdazzle +1 | 3.28.5-2.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | libepubgen +1 | 0.1.0-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | libsass +1 | 3.4.5-6.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | libsigc++20 +2 | 2.10.0-6.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | libvisual +1 | 1:0.4.0-25.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | mutter +1 | 3.32.2-57.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | nautilus +2 | 3.28.1-15.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | pangomm +2 | 2.40.1-6.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | soundtouch +1 | 2.0.0-3.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | vala +1 | 0.40.19-2.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | webkit2gtk3 +3 | 2.30.4-1.el8 | ELSA-2021-1586 |
| Oracle Linux 8 | woff2 +1 | 1.0.2-5.el8 | ELSA-2021-1586 |
Advisories 12
- ALSA-2021:1586 Moderate: GNOME security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:10364 Red Hat Security Advisory: webkitgtk4 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2025-0227 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2021:1586 Red Hat Security Advisory: GNOME security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4797-1 webkit2gtk - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2021:1586 Moderate: GNOME security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2020:3864-1 Security update for webkit2gtk3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1990-1 Security update for webkit2gtk3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3867-1 Security update for webkit2gtk3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:2310-1 Security update for webkit2gtk3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:2304-1 Security update for webkit2gtk3 SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2021-1586 Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 25, 2021