Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-31223 (GCVE-0-2025-31223)
Vulnerability from cvelistv5 – Published: 2025-05-12 21:42 – Updated: 2026-02-26 18:28
VLAI?
EPSS
Summary
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
Severity ?
CWE
- Processing maliciously crafted web content may lead to memory corruption
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-31223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-14T04:01:03.843196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:28:39.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:50:23.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2025/May/13"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/12"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/10"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/7"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "11.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing maliciously crafted web content may lead to memory corruption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-12T21:42:17.904Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/122720"
},
{
"url": "https://support.apple.com/en-us/122716"
},
{
"url": "https://support.apple.com/en-us/122404"
},
{
"url": "https://support.apple.com/en-us/122721"
},
{
"url": "https://support.apple.com/en-us/122722"
},
{
"url": "https://support.apple.com/en-us/122719"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-31223",
"datePublished": "2025-05-12T21:42:17.904Z",
"dateReserved": "2025-03-27T16:13:58.320Z",
"dateUpdated": "2026-02-26T18:28:39.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-31223\",\"sourceIdentifier\":\"product-security@apple.com\",\"published\":\"2025-05-12T22:15:23.060\",\"lastModified\":\"2025-11-03T20:18:19.683\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.\"},{\"lang\":\"es\",\"value\":\"El problema se solucion\u00f3 mejorando las comprobaciones. Este problema est\u00e1 corregido en watchOS 11.5, tvOS 18.5, iOS 18.5 y iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5 y Safari 18.5. El procesamiento de contenido web malintencionado puede provocar da\u00f1os en la memoria.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.5\",\"matchCriteriaId\":\"2911F28D-586D-4C43-BCE7-A8A77568E183\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.5\",\"matchCriteriaId\":\"D0459303-7D14-428D-9C4E-2C743AC9529F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.5\",\"matchCriteriaId\":\"AF6AAC00-F384-4B0D-BBA9-C2AD278BF653\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"15.5\",\"matchCriteriaId\":\"EF1B4AB8-2B51-4EED-BD29-C500C83FAB10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.5\",\"matchCriteriaId\":\"519C8A39-A24E-44B7-B1E8-6EF647FEFCA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.5\",\"matchCriteriaId\":\"047CDCCE-04BB-4D43-9831-7694992C5CC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.5\",\"matchCriteriaId\":\"0CBDEF1C-6D76-4F9D-8433-3AC16F3860F4\"}]}]}],\"references\":[{\"url\":\"https://support.apple.com/en-us/122404\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/122716\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/122719\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/122720\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/122721\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/122722\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2025/May/10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2025/May/12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2025/May/13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2025/May/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2025/May/7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://seclists.org/fulldisclosure/2025/May/13\"}, {\"url\": \"http://seclists.org/fulldisclosure/2025/May/12\"}, {\"url\": \"http://seclists.org/fulldisclosure/2025/May/10\"}, {\"url\": \"http://seclists.org/fulldisclosure/2025/May/7\"}, {\"url\": \"http://seclists.org/fulldisclosure/2025/May/5\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:50:23.028Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-31223\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-14T04:01:03.843196Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-119\", \"description\": \"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-13T13:27:36.137Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Apple\", \"product\": \"tvOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"18.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"macOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"15.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"iOS and iPadOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"18.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"visionOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"2.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"watchOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"11.5\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"Safari\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"18.5\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://support.apple.com/en-us/122720\"}, {\"url\": \"https://support.apple.com/en-us/122716\"}, {\"url\": \"https://support.apple.com/en-us/122404\"}, {\"url\": \"https://support.apple.com/en-us/122721\"}, {\"url\": \"https://support.apple.com/en-us/122722\"}, {\"url\": \"https://support.apple.com/en-us/122719\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"Processing maliciously crafted web content may lead to memory corruption\"}]}], \"providerMetadata\": {\"orgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"shortName\": \"apple\", \"dateUpdated\": \"2025-05-12T21:42:17.904Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-31223\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-26T18:28:39.975Z\", \"dateReserved\": \"2025-03-27T16:13:58.320Z\", \"assignerOrgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"datePublished\": \"2025-05-12T21:42:17.904Z\", \"assignerShortName\": \"apple\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
NCSC-2025-0150
Vulnerability from csaf_ncscnl - Published: 2025-05-13 09:14 - Updated: 2025-05-13 09:14Summary
Kwetsbaarheden verholpen in Apple iOS en iPadOS
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Apple heeft kwetsbaarheden verholpen in iOS en iPadOS.
Interpretaties: De kwetsbaarheden omvatten een scala aan problemen, zoals geheugenbeschadiging, ongeautoriseerde toegang tot gevoelige gegevens, en denial-of-service aanvallen. Deze kwetsbaarheden kunnen worden misbruikt door kwaadwillenden via verschillende vectoren, waaronder het verwerken van kwaadaardig webinhoud en het misbruiken van onjuiste invoervalidatie. De impact varieert van systeeminstabiliteit tot het risico op gegevenslekken.
Oplossingen: Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-415: Double Free
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-125: Out-of-bounds Read
CWE-404: Improper Resource Shutdown or Release
CWE-862: Missing Authorization
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-416: Use After Free
CWE-674: Uncontrolled Recursion
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-121: Stack-based Buffer Overflow
CWE-287: Improper Authentication
7.5 (High)
5.0 (Medium)
8.8 (High)
9.8 (Critical)
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-287
- Improper Authentication
CWE-119
- Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-415
- Double Free
CWE-416
- Use After Free
CWE-415
- Double Free
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-404
- Improper Resource Shutdown or Release
CWE-404
- Improper Resource Shutdown or Release
References
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Apple heeft kwetsbaarheden verholpen in iOS en iPadOS.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten een scala aan problemen, zoals geheugenbeschadiging, ongeautoriseerde toegang tot gevoelige gegevens, en denial-of-service aanvallen. Deze kwetsbaarheden kunnen worden misbruikt door kwaadwillenden via verschillende vectoren, waaronder het verwerken van kwaadaardig webinhoud en het misbruiken van onjuiste invoervalidatie. De impact varieert van systeeminstabiliteit tot het risico op gegevenslekken.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "general",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "general",
"text": "Improper Authentication",
"title": "CWE-287"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://support.apple.com/en-us/122404"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://support.apple.com/en-us/122405"
}
],
"title": "Kwetsbaarheden verholpen in Apple iOS en iPadOS",
"tracking": {
"current_release_date": "2025-05-13T09:14:44.606584Z",
"generator": {
"date": "2025-02-25T15:15:00Z",
"engine": {
"name": "V.A.",
"version": "1.0"
}
},
"id": "NCSC-2025-0150",
"initial_release_date": "2025-05-13T09:14:44.606584Z",
"revision_history": [
{
"date": "2025-05-13T09:14:44.606584Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/unspecified|\u003c18.5",
"product": {
"name": "vers:unknown/unspecified|\u003c18.5",
"product_id": "CSAFPID-2832294"
}
}
],
"category": "product_name",
"name": "iOS and iPadOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/\u003c17.7.6",
"product": {
"name": "vers:unknown/\u003c17.7.6",
"product_id": "CSAFPID-2592048"
}
}
],
"category": "product_name",
"name": "iPadOS"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-8176",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "other",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-8176",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-8176.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
}
],
"title": "CVE-2024-8176"
},
{
"cve": "CVE-2025-24097",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24097",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24097.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
}
],
"title": "CVE-2025-24097"
},
{
"cve": "CVE-2025-24111",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24111",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24111.json"
}
],
"title": "CVE-2025-24111"
},
{
"cve": "CVE-2025-24144",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24144",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24144.json"
}
],
"title": "CVE-2025-24144"
},
{
"cve": "CVE-2025-24213",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"notes": [
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24213",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24213.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
}
],
"title": "CVE-2025-24213"
},
{
"cve": "CVE-2025-24220",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24220",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24220.json"
}
],
"title": "CVE-2025-24220"
},
{
"cve": "CVE-2025-24223",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24223",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24223.json"
}
],
"title": "CVE-2025-24223"
},
{
"cve": "CVE-2025-24225",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24225",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24225.json"
}
],
"title": "CVE-2025-24225"
},
{
"cve": "CVE-2025-24259",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24259",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24259.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
}
],
"title": "CVE-2025-24259"
},
{
"cve": "CVE-2025-30448",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30448",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30448.json"
}
],
"title": "CVE-2025-30448"
},
{
"cve": "CVE-2025-31196",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31196",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31196.json"
}
],
"title": "CVE-2025-31196"
},
{
"cve": "CVE-2025-31204",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31204",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31204.json"
}
],
"title": "CVE-2025-31204"
},
{
"cve": "CVE-2025-31205",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31205",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31205.json"
}
],
"title": "CVE-2025-31205"
},
{
"cve": "CVE-2025-31206",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31206",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31206.json"
}
],
"title": "CVE-2025-31206"
},
{
"cve": "CVE-2025-31207",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31207",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31207.json"
}
],
"title": "CVE-2025-31207"
},
{
"cve": "CVE-2025-31208",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31208",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31208.json"
}
],
"title": "CVE-2025-31208"
},
{
"cve": "CVE-2025-31209",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31209",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31209.json"
}
],
"title": "CVE-2025-31209"
},
{
"cve": "CVE-2025-31210",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31210",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31210.json"
}
],
"title": "CVE-2025-31210"
},
{
"cve": "CVE-2025-31212",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31212",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31212.json"
}
],
"title": "CVE-2025-31212"
},
{
"cve": "CVE-2025-31213",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31213",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31213.json"
}
],
"title": "CVE-2025-31213"
},
{
"cve": "CVE-2025-31214",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31214",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31214.json"
}
],
"title": "CVE-2025-31214"
},
{
"cve": "CVE-2025-31215",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31215",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31215.json"
}
],
"title": "CVE-2025-31215"
},
{
"cve": "CVE-2025-31217",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31217",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31217.json"
}
],
"title": "CVE-2025-31217"
},
{
"cve": "CVE-2025-31219",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31219",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31219.json"
}
],
"title": "CVE-2025-31219"
},
{
"cve": "CVE-2025-31220",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31220",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31220.json"
}
],
"title": "CVE-2025-31220"
},
{
"cve": "CVE-2025-31221",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31221",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31221.json"
}
],
"title": "CVE-2025-31221"
},
{
"cve": "CVE-2025-31222",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31222",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31222.json"
}
],
"title": "CVE-2025-31222"
},
{
"cve": "CVE-2025-31223",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31223",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31223.json"
}
],
"title": "CVE-2025-31223"
},
{
"cve": "CVE-2025-31225",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31225",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31225.json"
}
],
"title": "CVE-2025-31225"
},
{
"cve": "CVE-2025-31226",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31226",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31226.json"
}
],
"title": "CVE-2025-31226"
},
{
"cve": "CVE-2025-31227",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31227",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31227.json"
}
],
"title": "CVE-2025-31227"
},
{
"cve": "CVE-2025-31228",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "other",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31228",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31228.json"
}
],
"title": "CVE-2025-31228"
},
{
"cve": "CVE-2025-31233",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31233",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31233.json"
}
],
"title": "CVE-2025-31233"
},
{
"cve": "CVE-2025-31234",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31234",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31234.json"
}
],
"title": "CVE-2025-31234"
},
{
"cve": "CVE-2025-31235",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31235",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31235.json"
}
],
"title": "CVE-2025-31235"
},
{
"cve": "CVE-2025-31238",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31238",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31238.json"
}
],
"title": "CVE-2025-31238"
},
{
"cve": "CVE-2025-31239",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31239",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31239.json"
}
],
"title": "CVE-2025-31239"
},
{
"cve": "CVE-2025-31241",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31241",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31241.json"
}
],
"title": "CVE-2025-31241"
},
{
"cve": "CVE-2025-31242",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31242",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31242.json"
}
],
"title": "CVE-2025-31242"
},
{
"cve": "CVE-2025-31245",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31245",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31245.json"
}
],
"title": "CVE-2025-31245"
},
{
"cve": "CVE-2025-31251",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31251",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31251.json"
}
],
"title": "CVE-2025-31251"
},
{
"cve": "CVE-2025-31253",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31253",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31253.json"
}
],
"title": "CVE-2025-31253"
},
{
"cve": "CVE-2025-31257",
"product_status": {
"known_affected": [
"CSAFPID-2832294",
"CSAFPID-2592048"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31257",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31257.json"
}
],
"title": "CVE-2025-31257"
}
]
}
NCSC-2025-0151
Vulnerability from csaf_ncscnl - Published: 2025-05-13 09:19 - Updated: 2025-05-13 09:19Summary
Kwetsbaarheden verholpen in Apple macOS
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Apple heeft kwetsbaarheden verholpen in macOS (Specifiek voor Ventura 13.7.6, Sequoia 15.5 en Sonoma 14.7.6).
Interpretaties: De kwetsbaarheden omvatten verschillende problemen, zoals geheugenbeschadiging door het verwerken van kwaadwillig gemaakte webinhoud, ongeautoriseerde toegang tot gevoelige gebruikersdata, en onverwachte systeemterminaties. Deze kwetsbaarheden kunnen worden misbruikt door kwaadwillenden om zich verhoogde rechten toe te kennen en zo toegang te krijgen tot gevoelige informatie of om de stabiliteit van het systeem in gevaar te brengen.
Oplossingen: Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-390: Detection of Error Condition Without Action
CWE-310: CWE-310
CWE-415: Double Free
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-265: CWE-265
CWE-404: Improper Resource Shutdown or Release
CWE-275: CWE-275
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-416: Use After Free
CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-674: Uncontrolled Recursion
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-121: Stack-based Buffer Overflow
7.5 (High)
8.8 (High)
6.8 (Medium)
5.9 (Medium)
5.5 (Medium)
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-119
- Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-415
- Double Free
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-416
- Use After Free
CWE-415
- Double Free
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-404
- Improper Resource Shutdown or Release
CWE-119
- Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
CWE-404
- Improper Resource Shutdown or Release
CWE-200
- Exposure of Sensitive Information to an Unauthorized Actor
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Apple heeft kwetsbaarheden verholpen in macOS (Specifiek voor Ventura 13.7.6, Sequoia 15.5 en Sonoma 14.7.6).",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten verschillende problemen, zoals geheugenbeschadiging door het verwerken van kwaadwillig gemaakte webinhoud, ongeautoriseerde toegang tot gevoelige gebruikersdata, en onverwachte systeemterminaties. Deze kwetsbaarheden kunnen worden misbruikt door kwaadwillenden om zich verhoogde rechten toe te kennen en zo toegang te krijgen tot gevoelige informatie of om de stabiliteit van het systeem in gevaar te brengen.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Detection of Error Condition Without Action",
"title": "CWE-390"
},
{
"category": "general",
"text": "CWE-310",
"title": "CWE-310"
},
{
"category": "general",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "general",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "general",
"text": "CWE-265",
"title": "CWE-265"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "CWE-275",
"title": "CWE-275"
},
{
"category": "general",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://support.apple.com/en-us/122718"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://support.apple.com/en-us/122717"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; nvd",
"url": "https://support.apple.com/en-us/122716"
}
],
"title": "Kwetsbaarheden verholpen in Apple macOS",
"tracking": {
"current_release_date": "2025-05-13T09:19:37.094950Z",
"generator": {
"date": "2025-02-25T15:15:00Z",
"engine": {
"name": "V.A.",
"version": "1.0"
}
},
"id": "NCSC-2025-0151",
"initial_release_date": "2025-05-13T09:19:37.094950Z",
"revision_history": [
{
"date": "2025-05-13T09:19:37.094950Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/\u003e=13.0|\u003c13.7.5",
"product": {
"name": "vers:unknown/\u003e=13.0|\u003c13.7.5",
"product_id": "CSAFPID-2620946",
"product_identification_helper": {
"cpe": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_version_range",
"name": "vers:unknown/\u003e=14.0|\u003c14.7.5",
"product": {
"name": "vers:unknown/\u003e=14.0|\u003c14.7.5",
"product_id": "CSAFPID-2620935",
"product_identification_helper": {
"cpe": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "macOS"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/\u003e=15.0|\u003c15.4",
"product": {
"name": "vers:unknown/\u003e=15.0|\u003c15.4",
"product_id": "CSAFPID-2592049"
}
}
],
"category": "product_name",
"name": "macOS"
}
],
"category": "product_family",
"name": "Apple"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-8176",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "other",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "general",
"text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-8176",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-8176.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
}
],
"title": "CVE-2024-8176"
},
{
"cve": "CVE-2025-24142",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24142",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24142.json"
}
],
"title": "CVE-2025-24142"
},
{
"cve": "CVE-2025-24144",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24144",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24144.json"
}
],
"title": "CVE-2025-24144"
},
{
"cve": "CVE-2025-24155",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24155",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24155.json"
}
],
"title": "CVE-2025-24155"
},
{
"cve": "CVE-2025-24213",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"notes": [
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24213",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24213.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
}
],
"title": "CVE-2025-24213"
},
{
"cve": "CVE-2025-24222",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24222",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24222.json"
}
],
"title": "CVE-2025-24222"
},
{
"cve": "CVE-2025-24223",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24223",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24223.json"
}
],
"title": "CVE-2025-24223"
},
{
"cve": "CVE-2025-24258",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24258",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24258.json"
}
],
"title": "CVE-2025-24258"
},
{
"cve": "CVE-2025-24274",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24274",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24274.json"
}
],
"title": "CVE-2025-24274"
},
{
"cve": "CVE-2025-26465",
"cwe": {
"id": "CWE-310",
"name": "-"
},
"notes": [
{
"category": "other",
"text": "CWE-310",
"title": "CWE-310"
},
{
"category": "other",
"text": "Detection of Error Condition Without Action",
"title": "CWE-390"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26465",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26465.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
}
],
"title": "CVE-2025-26465"
},
{
"cve": "CVE-2025-26466",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-26466",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26466.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
}
],
"title": "CVE-2025-26466"
},
{
"cve": "CVE-2025-30440",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30440",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30440.json"
}
],
"title": "CVE-2025-30440"
},
{
"cve": "CVE-2025-30442",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30442",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30442.json"
}
],
"title": "CVE-2025-30442"
},
{
"cve": "CVE-2025-30443",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30443",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30443.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
}
],
"title": "CVE-2025-30443"
},
{
"cve": "CVE-2025-30448",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30448",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30448.json"
}
],
"title": "CVE-2025-30448"
},
{
"cve": "CVE-2025-30453",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30453",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30453.json"
}
],
"title": "CVE-2025-30453"
},
{
"cve": "CVE-2025-31196",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31196",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31196.json"
}
],
"title": "CVE-2025-31196"
},
{
"cve": "CVE-2025-31204",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31204",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31204.json"
}
],
"title": "CVE-2025-31204"
},
{
"cve": "CVE-2025-31205",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31205",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31205.json"
}
],
"title": "CVE-2025-31205"
},
{
"cve": "CVE-2025-31206",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31206",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31206.json"
}
],
"title": "CVE-2025-31206"
},
{
"cve": "CVE-2025-31208",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31208",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31208.json"
}
],
"title": "CVE-2025-31208"
},
{
"cve": "CVE-2025-31209",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31209",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31209.json"
}
],
"title": "CVE-2025-31209"
},
{
"cve": "CVE-2025-31212",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31212",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31212.json"
}
],
"title": "CVE-2025-31212"
},
{
"cve": "CVE-2025-31213",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31213",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31213.json"
}
],
"title": "CVE-2025-31213"
},
{
"cve": "CVE-2025-31215",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31215",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31215.json"
}
],
"title": "CVE-2025-31215"
},
{
"cve": "CVE-2025-31217",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31217",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31217.json"
}
],
"title": "CVE-2025-31217"
},
{
"cve": "CVE-2025-31218",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31218",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31218.json"
}
],
"title": "CVE-2025-31218"
},
{
"cve": "CVE-2025-31219",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31219",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31219.json"
}
],
"title": "CVE-2025-31219"
},
{
"cve": "CVE-2025-31220",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31220",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31220.json"
}
],
"title": "CVE-2025-31220"
},
{
"cve": "CVE-2025-31221",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31221",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31221.json"
}
],
"title": "CVE-2025-31221"
},
{
"cve": "CVE-2025-31222",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31222",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31222.json"
}
],
"title": "CVE-2025-31222"
},
{
"cve": "CVE-2025-31223",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31223",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31223.json"
}
],
"title": "CVE-2025-31223"
},
{
"cve": "CVE-2025-31224",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31224",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31224.json"
}
],
"title": "CVE-2025-31224"
},
{
"cve": "CVE-2025-31226",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31226",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31226.json"
}
],
"title": "CVE-2025-31226"
},
{
"cve": "CVE-2025-31232",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31232",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31232.json"
}
],
"title": "CVE-2025-31232"
},
{
"cve": "CVE-2025-31233",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31233",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31233.json"
}
],
"title": "CVE-2025-31233"
},
{
"cve": "CVE-2025-31234",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31234",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31234.json"
}
],
"title": "CVE-2025-31234"
},
{
"cve": "CVE-2025-31235",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31235",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31235.json"
}
],
"title": "CVE-2025-31235"
},
{
"cve": "CVE-2025-31236",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31236",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31236.json"
}
],
"title": "CVE-2025-31236"
},
{
"cve": "CVE-2025-31237",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31237",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31237.json"
}
],
"title": "CVE-2025-31237"
},
{
"cve": "CVE-2025-31238",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31238",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31238.json"
}
],
"title": "CVE-2025-31238"
},
{
"cve": "CVE-2025-31239",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31239",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31239.json"
}
],
"title": "CVE-2025-31239"
},
{
"cve": "CVE-2025-31240",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31240",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31240.json"
}
],
"title": "CVE-2025-31240"
},
{
"cve": "CVE-2025-31241",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31241",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31241.json"
}
],
"title": "CVE-2025-31241"
},
{
"cve": "CVE-2025-31242",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31242",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31242.json"
}
],
"title": "CVE-2025-31242"
},
{
"cve": "CVE-2025-31244",
"cwe": {
"id": "CWE-265",
"name": "-"
},
"notes": [
{
"category": "other",
"text": "CWE-265",
"title": "CWE-265"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31244",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31244.json"
}
],
"title": "CVE-2025-31244"
},
{
"cve": "CVE-2025-31245",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31245",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31245.json"
}
],
"title": "CVE-2025-31245"
},
{
"cve": "CVE-2025-31246",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31246",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31246.json"
}
],
"title": "CVE-2025-31246"
},
{
"cve": "CVE-2025-31247",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31247",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31247.json"
}
],
"title": "CVE-2025-31247"
},
{
"cve": "CVE-2025-31249",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31249",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31249.json"
}
],
"title": "CVE-2025-31249"
},
{
"cve": "CVE-2025-31250",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31250",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31250.json"
}
],
"title": "CVE-2025-31250"
},
{
"cve": "CVE-2025-31251",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31251",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31251.json"
}
],
"title": "CVE-2025-31251"
},
{
"cve": "CVE-2025-31256",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31256",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31256.json"
}
],
"title": "CVE-2025-31256"
},
{
"cve": "CVE-2025-31257",
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31257",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31257.json"
}
],
"title": "CVE-2025-31257"
},
{
"cve": "CVE-2025-31258",
"cwe": {
"id": "CWE-265",
"name": "-"
},
"notes": [
{
"category": "other",
"text": "CWE-265",
"title": "CWE-265"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31258",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31258.json"
}
],
"title": "CVE-2025-31258"
},
{
"cve": "CVE-2025-31259",
"notes": [
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31259",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31259.json"
}
],
"title": "CVE-2025-31259"
},
{
"cve": "CVE-2025-31260",
"cwe": {
"id": "CWE-275",
"name": "-"
},
"notes": [
{
"category": "other",
"text": "CWE-275",
"title": "CWE-275"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-2620946",
"CSAFPID-2620935",
"CSAFPID-2592049"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31260",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31260.json"
}
],
"title": "CVE-2025-31260"
}
]
}
RHSA-2025:17643
Vulnerability from csaf_redhat - Published: 2025-10-09 06:01 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17643
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17643
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17643
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17643
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17643
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17643
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17643
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:17643",
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17643.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:35+00:00",
"generator": {
"date": "2026-03-20T01:06:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:17643",
"initial_release_date": "2025-10-09T06:01:13+00:00",
"revision_history": [
{
"date": "2025-10-09T06:01:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-09T06:01:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.0::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_0.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.src",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_0?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_0?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_0?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_0?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_0.src",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-09T06:01:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-09T06:01:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-09T06:01:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-09T06:01:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-09T06:01:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-09T06:01:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-09T06:01:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17643"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:19157
Vulnerability from csaf_redhat - Published: 2025-10-28 09:07 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19157
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19157
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19157
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19157
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19157
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19157
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19157
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:19157",
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19157.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:39+00:00",
"generator": {
"date": "2026-03-20T01:06:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:19157",
"initial_release_date": "2025-10-28T09:07:47+00:00",
"revision_history": [
{
"date": "2025-10-28T09:07:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-28T09:07:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_2.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_2.src",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_2.src as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_2.src",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T09:07:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T09:07:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T09:07:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T09:07:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T09:07:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T09:07:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T09:07:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19157"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:19109
Vulnerability from csaf_redhat - Published: 2025-10-27 19:58 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19109
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19109
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19109
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19109
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19109
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19109
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19109
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:19109",
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19109.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:42+00:00",
"generator": {
"date": "2026-03-20T01:06:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:19109",
"initial_release_date": "2025-10-27T19:58:20+00:00",
"revision_history": [
{
"date": "2025-10-27T19:58:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-27T19:58:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_tus:8.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_6.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.src",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-27T19:58:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-27T19:58:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-27T19:58:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-27T19:58:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-27T19:58:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-27T19:58:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-27T19:58:20+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19109"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:18097
Vulnerability from csaf_redhat - Published: 2025-10-15 11:46 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43343)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:18097
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:18097",
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "2403598",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403598"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_18097.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:39+00:00",
"generator": {
"date": "2026-03-20T01:06:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:18097",
"initial_release_date": "2025-10-15T11:46:25+00:00",
"revision_history": [
{
"date": "2025-10-15T11:46:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-15T11:46:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.1-0.el9_6.src",
"product": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.src",
"product_id": "webkit2gtk3-0:2.50.1-0.el9_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.1-0.el9_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.1-0.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.1-0.el9_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.1-0.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.1-0.el9_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.1-0.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.1-0.el9_6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.1-0.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.1-0.el9_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.1-0.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.1-0.el9_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.1-0.el9_6.src",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43343",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-10-13T20:00:18.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2403598"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43343"
},
{
"category": "external",
"summary": "RHBZ#2403598",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403598"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43343",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43343"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43343",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43343"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0007.html",
"url": "https://webkitgtk.org/security/WSA-2025-0007.html"
}
],
"release_date": "2025-10-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-15T11:46:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:18097"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.src",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.1-0.el9_6.x86_64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.aarch64",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.i686",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.ppc64le",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.s390x",
"AppStream-9.6.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.1-0.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:17802
Vulnerability from csaf_redhat - Published: 2025-10-13 13:24 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17802
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17802
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17802
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17802
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17802
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17802
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17802
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:17802",
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17802.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:39+00:00",
"generator": {
"date": "2026-03-20T01:06:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:17802",
"initial_release_date": "2025-10-13T13:24:14+00:00",
"revision_history": [
{
"date": "2025-10-13T13:24:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-13T13:24:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_10.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.src",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_10?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T13:24:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T13:24:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T13:24:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T13:24:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T13:24:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T13:24:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T13:24:14+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17802"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:17743
Vulnerability from csaf_redhat - Published: 2025-10-13 01:47 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17743
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17743
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17743
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17743
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17743
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17743
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17743
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:17743",
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17743.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:36+00:00",
"generator": {
"date": "2026-03-20T01:06:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:17743",
"initial_release_date": "2025-10-13T01:47:33+00:00",
"revision_history": [
{
"date": "2025-10-13T01:47:33+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-13T01:47:33+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_2.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.src",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_2.src",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:47:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:47:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:47:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:47:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:47:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:47:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:47:33+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:17807
Vulnerability from csaf_redhat - Published: 2025-10-13 18:21 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17807
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17807
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17807
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17807
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17807
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17807
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17807
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:17807",
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17807.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:39+00:00",
"generator": {
"date": "2026-03-20T01:06:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:17807",
"initial_release_date": "2025-10-13T18:21:40+00:00",
"revision_history": [
{
"date": "2025-10-13T18:21:40+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-13T18:21:40+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_8.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_8.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_8.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_8.1?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_8.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_8.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T18:21:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T18:21:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T18:21:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T18:21:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T18:21:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T18:21:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T18:21:40+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17807"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_8.1.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:19352
Vulnerability from csaf_redhat - Published: 2025-10-30 15:11 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkitgtk4 security update
Severity
Important
Notes
Topic: An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19352
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19352
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19352
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19352
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19352
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19352
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19352
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:19352",
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19352.json"
}
],
"title": "Red Hat Security Advisory: webkitgtk4 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:41+00:00",
"generator": {
"date": "2026-03-20T01:06:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:19352",
"initial_release_date": "2025-10-30T15:11:28+00:00",
"revision_history": [
{
"date": "2025-10-30T15:11:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-30T15:11:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.0-1.el7_9.src",
"product": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.src",
"product_id": "webkitgtk4-0:2.50.0-1.el7_9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.0-1.el7_9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"product": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"product_id": "webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.0-1.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"product": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"product_id": "webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-devel@2.50.0-1.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"product": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"product_id": "webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc@2.50.0-1.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"product": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"product_id": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc-devel@2.50.0-1.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"product": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"product_id": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-debuginfo@2.50.0-1.el7_9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.0-1.el7_9.s390x",
"product": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.s390x",
"product_id": "webkitgtk4-0:2.50.0-1.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.0-1.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"product": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"product_id": "webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc@2.50.0-1.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"product": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"product_id": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-debuginfo@2.50.0-1.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"product": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"product_id": "webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-devel@2.50.0-1.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"product": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"product_id": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc-devel@2.50.0-1.el7_9?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"product_id": "webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.0-1.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"product_id": "webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-devel@2.50.0-1.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"product_id": "webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc@2.50.0-1.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"product_id": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc-devel@2.50.0-1.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"product_id": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-debuginfo@2.50.0-1.el7_9?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"product": {
"name": "webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"product_id": "webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-doc@2.50.0-1.el7_9?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.src",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-doc-0:2.50.0-1.el7_9.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch"
},
"product_reference": "webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.src",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-doc-0:2.50.0-1.el7_9.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch"
},
"product_reference": "webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-30T15:11:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-30T15:11:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-30T15:11:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-30T15:11:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-30T15:11:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-30T15:11:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-30T15:11:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19352"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.0-1.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.0-1.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.0-1.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:19165
Vulnerability from csaf_redhat - Published: 2025-10-28 11:21 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19165
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19165
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19165
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19165
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19165
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19165
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:19165
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:19165",
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19165.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:41+00:00",
"generator": {
"date": "2026-03-20T01:06:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:19165",
"initial_release_date": "2025-10-28T11:21:52+00:00",
"revision_history": [
{
"date": "2025-10-28T11:21:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-28T11:21:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.4::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_4.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.src",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_4?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-1.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-1.el8_4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_4.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_4.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T11:21:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T11:21:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T11:21:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T11:21:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T11:21:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T11:21:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-28T11:21:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:19165"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.0-1.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-1.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
RHSA-2025:17741
Vulnerability from csaf_redhat - Published: 2025-10-13 01:44 - Updated: 2026-03-20 01:06Summary
Red Hat Security Advisory: webkit2gtk3 security update
Severity
Important
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17741
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17741
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17741
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17741
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.
6.5 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17741
Workaround
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17741
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
8.8 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:17741
Workaround
Do not process or load untrusted web content with WebKitGTK.
In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.
This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.
To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.
Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)\n\n* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:17741",
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17741.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2026-03-20T01:06:37+00:00",
"generator": {
"date": "2026-03-20T01:06:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2025:17741",
"initial_release_date": "2025-10-13T01:44:23+00:00",
"revision_history": [
{
"date": "2025-10-13T01:44:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-10-13T01:44:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-20T01:06:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_4.src",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.src",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_4?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_4?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_4?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.0-2.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.0-2.el9_4?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_4.src",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31223",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:05:08.854000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448779"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31223"
},
{
"category": "external",
"summary": "RHBZ#2448779",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448779"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:44:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-31277",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T20:06:11.785000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31277"
},
{
"category": "external",
"summary": "RHBZ#2448780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31277"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2026-0001.html",
"url": "https://webkitgtk.org/security/WSA-2026-0001.html"
}
],
"release_date": "2026-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:44:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43272",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-09-23T14:16:52.764000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397626"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43272"
},
{
"category": "external",
"summary": "RHBZ#2397626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43272",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43272"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:44:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43342",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-09-23T14:22:01.761000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43342"
},
{
"category": "external",
"summary": "RHBZ#2397627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43342"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:44:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43356",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-09-23T14:24:33.860000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397628"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may be able to access sensor information without user consent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43356"
},
{
"category": "external",
"summary": "RHBZ#2397628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43356",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43356"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:44:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may be able to access sensor information without user consent"
},
{
"cve": "CVE-2025-43368",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-09-23T14:25:57.502000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397630"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43368"
},
{
"category": "external",
"summary": "RHBZ#2397630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397630"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43368",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43368"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0006.html",
"url": "https://webkitgtk.org/security/WSA-2025-0006.html"
}
],
"release_date": "2025-09-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:44:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43419",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:41:22.388000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43419"
},
{
"category": "external",
"summary": "RHBZ#2416326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43419"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43419"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-10-13T01:44:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:17741"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.0-2.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.0-2.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
}
]
}
CERTFR-2025-AVI-0393
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Apple indique que la vulnérabilité CVE-2025-31200 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | macOS | macOS Sonoma versions antérieures à 14.7.6 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.5 | ||
| Apple | iPadOS | iPadOS versions 18.x antérieures à 18.5 | ||
| Apple | N/A | watchOS versions antérieures à 11.5 | ||
| Apple | Safari | Safari versions antérieures à 18.5 | ||
| Apple | N/A | visionOS versions antérieures à 2.5 | ||
| Apple | macOS | macOS Ventura versions antérieures à 13.7.6 | ||
| Apple | iPadOS | iPadOS versions antérieures à 17.7.7 | ||
| Apple | iOS | iOS versions antérieures à 18.5 | ||
| Apple | N/A | tvOS versions antérieures à 18.5 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.7.6",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.5",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions 18.x ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 11.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 2.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Ventura versions ant\u00e9rieures \u00e0 13.7.6",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 17.7.7",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-31240",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31240"
},
{
"name": "CVE-2025-31247",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31247"
},
{
"name": "CVE-2025-26465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26465"
},
{
"name": "CVE-2025-31221",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31221"
},
{
"name": "CVE-2025-31209",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31209"
},
{
"name": "CVE-2025-24155",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24155"
},
{
"name": "CVE-2025-31204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31204"
},
{
"name": "CVE-2025-31227",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31227"
},
{
"name": "CVE-2025-31218",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31218"
},
{
"name": "CVE-2025-31228",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31228"
},
{
"name": "CVE-2025-31226",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31226"
},
{
"name": "CVE-2025-31212",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31212"
},
{
"name": "CVE-2025-26466",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26466"
},
{
"name": "CVE-2025-31208",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31208"
},
{
"name": "CVE-2024-8176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8176"
},
{
"name": "CVE-2025-24144",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24144"
},
{
"name": "CVE-2025-30440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30440"
},
{
"name": "CVE-2025-24142",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24142"
},
{
"name": "CVE-2025-24225",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24225"
},
{
"name": "CVE-2025-31219",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31219"
},
{
"name": "CVE-2025-31251",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31251"
},
{
"name": "CVE-2025-31217",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31217"
},
{
"name": "CVE-2025-31241",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31241"
},
{
"name": "CVE-2025-31196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31196"
},
{
"name": "CVE-2025-31234",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31234"
},
{
"name": "CVE-2025-31245",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31245"
},
{
"name": "CVE-2025-31220",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31220"
},
{
"name": "CVE-2025-30442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30442"
},
{
"name": "CVE-2025-31235",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31235"
},
{
"name": "CVE-2025-31200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31200"
},
{
"name": "CVE-2025-24097",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24097"
},
{
"name": "CVE-2025-30448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30448"
},
{
"name": "CVE-2025-31249",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31249"
},
{
"name": "CVE-2025-24274",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24274"
},
{
"name": "CVE-2025-31238",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31238"
},
{
"name": "CVE-2025-24220",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24220"
},
{
"name": "CVE-2025-31210",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31210"
},
{
"name": "CVE-2025-31207",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31207"
},
{
"name": "CVE-2025-31242",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31242"
},
{
"name": "CVE-2025-31206",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31206"
},
{
"name": "CVE-2025-31244",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31244"
},
{
"name": "CVE-2025-24259",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24259"
},
{
"name": "CVE-2025-31259",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31259"
},
{
"name": "CVE-2025-31232",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31232"
},
{
"name": "CVE-2025-31250",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31250"
},
{
"name": "CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"name": "CVE-2025-31224",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31224"
},
{
"name": "CVE-2025-31214",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31214"
},
{
"name": "CVE-2025-31246",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31246"
},
{
"name": "CVE-2025-31213",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31213"
},
{
"name": "CVE-2025-31256",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31256"
},
{
"name": "CVE-2025-24258",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24258"
},
{
"name": "CVE-2025-24111",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24111"
},
{
"name": "CVE-2025-24222",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24222"
},
{
"name": "CVE-2025-31225",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31225"
},
{
"name": "CVE-2025-31205",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31205"
},
{
"name": "CVE-2025-24223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24223"
},
{
"name": "CVE-2025-24213",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24213"
},
{
"name": "CVE-2025-31260",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31260"
},
{
"name": "CVE-2025-31236",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31236"
},
{
"name": "CVE-2025-31222",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31222"
},
{
"name": "CVE-2025-31237",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31237"
},
{
"name": "CVE-2025-31257",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31257"
},
{
"name": "CVE-2025-31239",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31239"
},
{
"name": "CVE-2025-31233",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31233"
},
{
"name": "CVE-2025-30453",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30453"
},
{
"name": "CVE-2025-31258",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31258"
},
{
"name": "CVE-2025-31253",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31253"
},
{
"name": "CVE-2025-31215",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31215"
},
{
"name": "CVE-2025-30443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30443"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0393",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.\n\nApple indique que la vuln\u00e9rabilit\u00e9 CVE-2025-31200 est activement exploit\u00e9e.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122404",
"url": "https://support.apple.com/en-us/122404"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122717",
"url": "https://support.apple.com/en-us/122717"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122405",
"url": "https://support.apple.com/en-us/122405"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122716",
"url": "https://support.apple.com/en-us/122716"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122718",
"url": "https://support.apple.com/en-us/122718"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122721",
"url": "https://support.apple.com/en-us/122721"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122720",
"url": "https://support.apple.com/en-us/122720"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122719",
"url": "https://support.apple.com/en-us/122719"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122722",
"url": "https://support.apple.com/en-us/122722"
}
]
}
CERTFR-2025-AVI-0393
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Apple indique que la vulnérabilité CVE-2025-31200 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | macOS | macOS Sonoma versions antérieures à 14.7.6 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.5 | ||
| Apple | iPadOS | iPadOS versions 18.x antérieures à 18.5 | ||
| Apple | N/A | watchOS versions antérieures à 11.5 | ||
| Apple | Safari | Safari versions antérieures à 18.5 | ||
| Apple | N/A | visionOS versions antérieures à 2.5 | ||
| Apple | macOS | macOS Ventura versions antérieures à 13.7.6 | ||
| Apple | iPadOS | iPadOS versions antérieures à 17.7.7 | ||
| Apple | iOS | iOS versions antérieures à 18.5 | ||
| Apple | N/A | tvOS versions antérieures à 18.5 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.7.6",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.5",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions 18.x ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 11.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 2.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Ventura versions ant\u00e9rieures \u00e0 13.7.6",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 17.7.7",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 18.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-31240",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31240"
},
{
"name": "CVE-2025-31247",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31247"
},
{
"name": "CVE-2025-26465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26465"
},
{
"name": "CVE-2025-31221",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31221"
},
{
"name": "CVE-2025-31209",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31209"
},
{
"name": "CVE-2025-24155",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24155"
},
{
"name": "CVE-2025-31204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31204"
},
{
"name": "CVE-2025-31227",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31227"
},
{
"name": "CVE-2025-31218",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31218"
},
{
"name": "CVE-2025-31228",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31228"
},
{
"name": "CVE-2025-31226",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31226"
},
{
"name": "CVE-2025-31212",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31212"
},
{
"name": "CVE-2025-26466",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26466"
},
{
"name": "CVE-2025-31208",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31208"
},
{
"name": "CVE-2024-8176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8176"
},
{
"name": "CVE-2025-24144",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24144"
},
{
"name": "CVE-2025-30440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30440"
},
{
"name": "CVE-2025-24142",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24142"
},
{
"name": "CVE-2025-24225",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24225"
},
{
"name": "CVE-2025-31219",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31219"
},
{
"name": "CVE-2025-31251",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31251"
},
{
"name": "CVE-2025-31217",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31217"
},
{
"name": "CVE-2025-31241",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31241"
},
{
"name": "CVE-2025-31196",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31196"
},
{
"name": "CVE-2025-31234",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31234"
},
{
"name": "CVE-2025-31245",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31245"
},
{
"name": "CVE-2025-31220",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31220"
},
{
"name": "CVE-2025-30442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30442"
},
{
"name": "CVE-2025-31235",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31235"
},
{
"name": "CVE-2025-31200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31200"
},
{
"name": "CVE-2025-24097",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24097"
},
{
"name": "CVE-2025-30448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30448"
},
{
"name": "CVE-2025-31249",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31249"
},
{
"name": "CVE-2025-24274",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24274"
},
{
"name": "CVE-2025-31238",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31238"
},
{
"name": "CVE-2025-24220",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24220"
},
{
"name": "CVE-2025-31210",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31210"
},
{
"name": "CVE-2025-31207",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31207"
},
{
"name": "CVE-2025-31242",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31242"
},
{
"name": "CVE-2025-31206",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31206"
},
{
"name": "CVE-2025-31244",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31244"
},
{
"name": "CVE-2025-24259",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24259"
},
{
"name": "CVE-2025-31259",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31259"
},
{
"name": "CVE-2025-31232",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31232"
},
{
"name": "CVE-2025-31250",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31250"
},
{
"name": "CVE-2025-31223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31223"
},
{
"name": "CVE-2025-31224",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31224"
},
{
"name": "CVE-2025-31214",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31214"
},
{
"name": "CVE-2025-31246",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31246"
},
{
"name": "CVE-2025-31213",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31213"
},
{
"name": "CVE-2025-31256",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31256"
},
{
"name": "CVE-2025-24258",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24258"
},
{
"name": "CVE-2025-24111",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24111"
},
{
"name": "CVE-2025-24222",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24222"
},
{
"name": "CVE-2025-31225",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31225"
},
{
"name": "CVE-2025-31205",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31205"
},
{
"name": "CVE-2025-24223",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24223"
},
{
"name": "CVE-2025-24213",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24213"
},
{
"name": "CVE-2025-31260",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31260"
},
{
"name": "CVE-2025-31236",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31236"
},
{
"name": "CVE-2025-31222",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31222"
},
{
"name": "CVE-2025-31237",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31237"
},
{
"name": "CVE-2025-31257",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31257"
},
{
"name": "CVE-2025-31239",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31239"
},
{
"name": "CVE-2025-31233",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31233"
},
{
"name": "CVE-2025-30453",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30453"
},
{
"name": "CVE-2025-31258",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31258"
},
{
"name": "CVE-2025-31253",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31253"
},
{
"name": "CVE-2025-31215",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31215"
},
{
"name": "CVE-2025-30443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30443"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0393",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.\n\nApple indique que la vuln\u00e9rabilit\u00e9 CVE-2025-31200 est activement exploit\u00e9e.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122404",
"url": "https://support.apple.com/en-us/122404"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122717",
"url": "https://support.apple.com/en-us/122717"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122405",
"url": "https://support.apple.com/en-us/122405"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122716",
"url": "https://support.apple.com/en-us/122716"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122718",
"url": "https://support.apple.com/en-us/122718"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122721",
"url": "https://support.apple.com/en-us/122721"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122720",
"url": "https://support.apple.com/en-us/122720"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122719",
"url": "https://support.apple.com/en-us/122719"
},
{
"published_at": "2025-05-12",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 122722",
"url": "https://support.apple.com/en-us/122722"
}
]
}
FKIE_CVE-2025-31223
Vulnerability from fkie_nvd - Published: 2025-05-12 22:15 - Updated: 2025-11-03 20:18
Severity ?
Summary
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
References
| URL | Tags | ||
|---|---|---|---|
| product-security@apple.com | https://support.apple.com/en-us/122404 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/122716 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/122719 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/122720 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/122721 | Release Notes, Vendor Advisory | |
| product-security@apple.com | https://support.apple.com/en-us/122722 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2025/May/10 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2025/May/12 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2025/May/13 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2025/May/5 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2025/May/7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2911F28D-586D-4C43-BCE7-A8A77568E183",
"versionEndExcluding": "18.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D0459303-7D14-428D-9C4E-2C743AC9529F",
"versionEndExcluding": "18.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6AAC00-F384-4B0D-BBA9-C2AD278BF653",
"versionEndExcluding": "18.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EF1B4AB8-2B51-4EED-BD29-C500C83FAB10",
"versionEndExcluding": "15.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "519C8A39-A24E-44B7-B1E8-6EF647FEFCA8",
"versionEndExcluding": "18.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "047CDCCE-04BB-4D43-9831-7694992C5CC4",
"versionEndExcluding": "2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0CBDEF1C-6D76-4F9D-8433-3AC16F3860F4",
"versionEndExcluding": "11.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption."
},
{
"lang": "es",
"value": "El problema se solucion\u00f3 mejorando las comprobaciones. Este problema est\u00e1 corregido en watchOS 11.5, tvOS 18.5, iOS 18.5 y iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5 y Safari 18.5. El procesamiento de contenido web malintencionado puede provocar da\u00f1os en la memoria."
}
],
"id": "CVE-2025-31223",
"lastModified": "2025-11-03T20:18:19.683",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-05-12T22:15:23.060",
"references": [
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/122404"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/122716"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/122719"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/122720"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/122721"
},
{
"source": "product-security@apple.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://support.apple.com/en-us/122722"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2025/May/10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2025/May/12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2025/May/13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2025/May/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2025/May/7"
}
],
"sourceIdentifier": "product-security@apple.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
WID-SEC-W-2025-1007
Vulnerability from csaf_certbund - Published: 2025-05-12 22:00 - Updated: 2025-11-23 23:00Summary
Apple macOS: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Apple macOS ist ein Betriebssystem, das auf FreeBSD und Mach basiert.
Angriff: Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um erhöhte Privilegien zu erlangen, vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.
Betroffene Betriebssysteme: - MacOS X
References
| URL | Category | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Apple macOS ist ein Betriebssystem, das auf FreeBSD und Mach basiert.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um erh\u00f6hte Privilegien zu erlangen, vertrauliche Informationen offenzulegen, beliebigen Code auszuf\u00fchren, Daten zu manipulieren, Sicherheitsma\u00dfnahmen zu umgehen oder einen Denial-of-Service-Zustand auszul\u00f6sen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- MacOS X",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-1007 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1007.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-1007 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1007"
},
{
"category": "external",
"summary": "APPLE-SA-05-12-2025-3 macOS Sequoia 15.5 vom 2025-05-12",
"url": "https://lists.apple.com/archives/security-announce/2025/May/msg00002.html"
},
{
"category": "external",
"summary": "APPLE-SA-05-12-2025-4 macOS Sonoma 14.7.6 vom 2025-05-12",
"url": "https://lists.apple.com/archives/security-announce/2025/May/msg00003.html"
},
{
"category": "external",
"summary": "APPLE-SA-05-12-2025-5 macOS Ventura 13.7.6 vom 2025-05-12",
"url": "https://lists.apple.com/archives/security-announce/2025/May/msg00004.html"
},
{
"category": "external",
"summary": "macOS Sequoia 15.5 vom 2025-05-12",
"url": "https://support.apple.com/en-us/122716"
},
{
"category": "external",
"summary": "macOS Sonoma 14.7.6 vom 2025-05-12",
"url": "https://support.apple.com/en-us/122717"
},
{
"category": "external",
"summary": "macOS Ventura 13.7.6 vom 2025-05-12",
"url": "https://support.apple.com/en-us/122718"
}
],
"source_lang": "en-US",
"title": "Apple macOS: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-11-23T23:00:00.000+00:00",
"generator": {
"date": "2025-11-24T06:17:14.247+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2025-1007",
"initial_release_date": "2025-05-12T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-05-12T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-05-15T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2025-14863, EUVD-2025-14780"
},
{
"date": "2025-11-23T23:00:00.000+00:00",
"number": "3",
"summary": "CVE-2025-31248, CVE-2025-31266, CVE-2025-43374 erg\u00e4nzt"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "Sequoia \u003c15.5",
"product": {
"name": "Apple macOS Sequoia \u003c15.5",
"product_id": "T043571"
}
},
{
"category": "product_version",
"name": "Sequoia 15.5",
"product": {
"name": "Apple macOS Sequoia 15.5",
"product_id": "T043571-fixed",
"product_identification_helper": {
"cpe": "cpe:/o:apple:mac_os:sequoia__15.5"
}
}
},
{
"category": "product_version_range",
"name": "Sonoma \u003c14.7.6",
"product": {
"name": "Apple macOS Sonoma \u003c14.7.6",
"product_id": "T043572"
}
},
{
"category": "product_version",
"name": "Sonoma 14.7.6",
"product": {
"name": "Apple macOS Sonoma 14.7.6",
"product_id": "T043572-fixed",
"product_identification_helper": {
"cpe": "cpe:/o:apple:mac_os:sonoma__14.7.6"
}
}
},
{
"category": "product_version_range",
"name": "Ventura \u003c13.7.6",
"product": {
"name": "Apple macOS Ventura \u003c13.7.6",
"product_id": "T043573"
}
},
{
"category": "product_version",
"name": "Ventura 13.7.6",
"product": {
"name": "Apple macOS Ventura 13.7.6",
"product_id": "T043573-fixed",
"product_identification_helper": {
"cpe": "cpe:/o:apple:mac_os:ventura__13.7.6"
}
}
}
],
"category": "product_name",
"name": "macOS"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-8176",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2024-8176"
},
{
"cve": "CVE-2025-24142",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24142"
},
{
"cve": "CVE-2025-24144",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24144"
},
{
"cve": "CVE-2025-24155",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24155"
},
{
"cve": "CVE-2025-24213",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24213"
},
{
"cve": "CVE-2025-24222",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24222"
},
{
"cve": "CVE-2025-24223",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24223"
},
{
"cve": "CVE-2025-24258",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24258"
},
{
"cve": "CVE-2025-24274",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24274"
},
{
"cve": "CVE-2025-26465",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-26465"
},
{
"cve": "CVE-2025-26466",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-26466"
},
{
"cve": "CVE-2025-30440",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-30440"
},
{
"cve": "CVE-2025-30442",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-30442"
},
{
"cve": "CVE-2025-30443",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-30443"
},
{
"cve": "CVE-2025-30448",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-30448"
},
{
"cve": "CVE-2025-30453",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-30453"
},
{
"cve": "CVE-2025-31196",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31196"
},
{
"cve": "CVE-2025-31204",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31204"
},
{
"cve": "CVE-2025-31205",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31205"
},
{
"cve": "CVE-2025-31206",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31206"
},
{
"cve": "CVE-2025-31208",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31208"
},
{
"cve": "CVE-2025-31209",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31209"
},
{
"cve": "CVE-2025-31212",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31212"
},
{
"cve": "CVE-2025-31213",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31213"
},
{
"cve": "CVE-2025-31215",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31215"
},
{
"cve": "CVE-2025-31217",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31217"
},
{
"cve": "CVE-2025-31218",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31218"
},
{
"cve": "CVE-2025-31219",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31219"
},
{
"cve": "CVE-2025-31220",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31220"
},
{
"cve": "CVE-2025-31221",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31221"
},
{
"cve": "CVE-2025-31222",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31222"
},
{
"cve": "CVE-2025-31223",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31223"
},
{
"cve": "CVE-2025-31224",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31224"
},
{
"cve": "CVE-2025-31226",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31226"
},
{
"cve": "CVE-2025-31232",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31232"
},
{
"cve": "CVE-2025-31233",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31233"
},
{
"cve": "CVE-2025-31234",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31234"
},
{
"cve": "CVE-2025-31235",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31235"
},
{
"cve": "CVE-2025-31236",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31236"
},
{
"cve": "CVE-2025-31237",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31237"
},
{
"cve": "CVE-2025-31238",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31238"
},
{
"cve": "CVE-2025-31239",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31239"
},
{
"cve": "CVE-2025-31240",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31240"
},
{
"cve": "CVE-2025-31241",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31241"
},
{
"cve": "CVE-2025-31242",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31242"
},
{
"cve": "CVE-2025-31244",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31244"
},
{
"cve": "CVE-2025-31245",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31245"
},
{
"cve": "CVE-2025-31246",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31246"
},
{
"cve": "CVE-2025-31247",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31247"
},
{
"cve": "CVE-2025-31248",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31248"
},
{
"cve": "CVE-2025-31249",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31249"
},
{
"cve": "CVE-2025-31250",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31250"
},
{
"cve": "CVE-2025-31251",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31251"
},
{
"cve": "CVE-2025-31256",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31256"
},
{
"cve": "CVE-2025-31257",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31257"
},
{
"cve": "CVE-2025-31258",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31258"
},
{
"cve": "CVE-2025-31259",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31259"
},
{
"cve": "CVE-2025-31260",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31260"
},
{
"cve": "CVE-2025-31266",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31266"
},
{
"cve": "CVE-2025-43374",
"product_status": {
"known_affected": [
"T043571",
"T043572",
"T043573"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-43374"
}
]
}
WID-SEC-W-2025-1003
Vulnerability from csaf_certbund - Published: 2025-05-12 22:00 - Updated: 2025-05-15 22:00Summary
Apple iOS und iPadOS: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Das Apple iOS (vormals iPhone OS) ist das Betriebssystem für das von Apple entwickelte Smartphone iPhone, iPad und iPod Touch.
Das Apple iPadOS ist das Betriebssystem für das von Apple entwickelte iPad.
Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple iOS und Apple iPadOS ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen preiszugeben oder Spoofing-Angriffe durchzuführen.
Betroffene Betriebssysteme: - MacOS X
References
| URL | Category | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Das Apple iOS (vormals iPhone OS) ist das Betriebssystem f\u00fcr das von Apple entwickelte Smartphone iPhone, iPad und iPod Touch.\r\nDas Apple iPadOS ist das Betriebssystem f\u00fcr das von Apple entwickelte iPad.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple iOS und Apple iPadOS ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen preiszugeben oder Spoofing-Angriffe durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- MacOS X",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-1003 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1003.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-1003 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1003"
},
{
"category": "external",
"summary": "APPLE-SA-05-12-2025-1 iOS 18.5 and iPadOS 18.5 vom 2025-05-12",
"url": "https://lists.apple.com/archives/security-announce/2025/May/msg00000.html"
},
{
"category": "external",
"summary": "APPLE-SA-05-12-2025-2 iPadOS 17.7.7 vom 2025-05-12",
"url": "https://lists.apple.com/archives/security-announce/2025/May/msg00001.html"
},
{
"category": "external",
"summary": "iOS 18.5 and iPadOS 18.5 vom 2025-05-12",
"url": "https://support.apple.com/en-us/122404"
},
{
"category": "external",
"summary": "iPadOS 17.7.7 vom 2025-05-12",
"url": "https://support.apple.com/en-us/122405"
}
],
"source_lang": "en-US",
"title": "Apple iOS und iPadOS: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-05-15T22:00:00.000+00:00",
"generator": {
"date": "2025-05-16T07:45:34.621+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.12"
}
},
"id": "WID-SEC-W-2025-1003",
"initial_release_date": "2025-05-12T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-05-12T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-05-15T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2025-14780, EUVD-2025-14863"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c18.5",
"product": {
"name": "Apple iOS \u003c18.5",
"product_id": "T043555"
}
},
{
"category": "product_version",
"name": "18.5",
"product": {
"name": "Apple iOS 18.5",
"product_id": "T043555-fixed",
"product_identification_helper": {
"cpe": "cpe:/o:apple:iphone_os:18.5"
}
}
}
],
"category": "product_name",
"name": "iOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c18.5",
"product": {
"name": "Apple iPadOS \u003c18.5",
"product_id": "T043556"
}
},
{
"category": "product_version",
"name": "18.5",
"product": {
"name": "Apple iPadOS 18.5",
"product_id": "T043556-fixed",
"product_identification_helper": {
"cpe": "cpe:/o:apple:ipados:18.5"
}
}
},
{
"category": "product_version_range",
"name": "\u003c17.7.7",
"product": {
"name": "Apple iPadOS \u003c17.7.7",
"product_id": "T043557"
}
},
{
"category": "product_version",
"name": "17.7.7",
"product": {
"name": "Apple iPadOS 17.7.7",
"product_id": "T043557-fixed",
"product_identification_helper": {
"cpe": "cpe:/o:apple:ipados:17.7.7"
}
}
}
],
"category": "product_name",
"name": "iPadOS"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-8176",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2024-8176"
},
{
"cve": "CVE-2025-24097",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24097"
},
{
"cve": "CVE-2025-24111",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24111"
},
{
"cve": "CVE-2025-24144",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24144"
},
{
"cve": "CVE-2025-24213",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24213"
},
{
"cve": "CVE-2025-24220",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24220"
},
{
"cve": "CVE-2025-24223",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24223"
},
{
"cve": "CVE-2025-24225",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24225"
},
{
"cve": "CVE-2025-24259",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24259"
},
{
"cve": "CVE-2025-30448",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-30448"
},
{
"cve": "CVE-2025-31196",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31196"
},
{
"cve": "CVE-2025-31204",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31204"
},
{
"cve": "CVE-2025-31205",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31205"
},
{
"cve": "CVE-2025-31206",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31206"
},
{
"cve": "CVE-2025-31207",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31207"
},
{
"cve": "CVE-2025-31208",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31208"
},
{
"cve": "CVE-2025-31209",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31209"
},
{
"cve": "CVE-2025-31210",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31210"
},
{
"cve": "CVE-2025-31212",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31212"
},
{
"cve": "CVE-2025-31213",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31213"
},
{
"cve": "CVE-2025-31214",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31214"
},
{
"cve": "CVE-2025-31215",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31215"
},
{
"cve": "CVE-2025-31217",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31217"
},
{
"cve": "CVE-2025-31219",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31219"
},
{
"cve": "CVE-2025-31220",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31220"
},
{
"cve": "CVE-2025-31221",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31221"
},
{
"cve": "CVE-2025-31222",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31222"
},
{
"cve": "CVE-2025-31223",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31223"
},
{
"cve": "CVE-2025-31225",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31225"
},
{
"cve": "CVE-2025-31226",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31226"
},
{
"cve": "CVE-2025-31227",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31227"
},
{
"cve": "CVE-2025-31228",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31228"
},
{
"cve": "CVE-2025-31233",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31233"
},
{
"cve": "CVE-2025-31234",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31234"
},
{
"cve": "CVE-2025-31235",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31235"
},
{
"cve": "CVE-2025-31238",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31238"
},
{
"cve": "CVE-2025-31239",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31239"
},
{
"cve": "CVE-2025-31241",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31241"
},
{
"cve": "CVE-2025-31242",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31242"
},
{
"cve": "CVE-2025-31245",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31245"
},
{
"cve": "CVE-2025-31251",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31251"
},
{
"cve": "CVE-2025-31253",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31253"
},
{
"cve": "CVE-2025-31257",
"product_status": {
"known_affected": [
"T043555",
"T043556",
"T043557"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31257"
}
]
}
WID-SEC-W-2025-1010
Vulnerability from csaf_certbund - Published: 2025-05-12 22:00 - Updated: 2025-05-15 22:00Summary
Apple Safari: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Safari ist der auf Apple Geräten eingesetzte Web Browser.
Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple Safari ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen auszuspähen oder potentiell eigenen Code zur Ausführung zu bringen.
Betroffene Betriebssysteme: - Sonstiges
- UNIX
References
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Safari ist der auf Apple Ger\u00e4ten eingesetzte Web Browser.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple Safari ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, Informationen auszusp\u00e4hen oder potentiell eigenen Code zur Ausf\u00fchrung zu bringen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-1010 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1010.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-1010 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1010"
},
{
"category": "external",
"summary": "APPLE-SA-05-12-2025-9 Safari 18.5 vom 2025-05-12",
"url": "https://lists.apple.com/archives/security-announce/2025/May/msg00008.html"
},
{
"category": "external",
"summary": "Safari 18.5 vom 2025-05-12",
"url": "https://support.apple.com/en-us/122719"
}
],
"source_lang": "en-US",
"title": "Apple Safari: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-05-15T22:00:00.000+00:00",
"generator": {
"date": "2025-05-16T07:45:35.335+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.12"
}
},
"id": "WID-SEC-W-2025-1010",
"initial_release_date": "2025-05-12T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-05-12T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-05-15T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2025-14780"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c18.5",
"product": {
"name": "Apple Safari \u003c18.5",
"product_id": "T043579"
}
},
{
"category": "product_version",
"name": "18.5",
"product": {
"name": "Apple Safari 18.5",
"product_id": "T043579-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:apple:safari:18.5"
}
}
}
],
"category": "product_name",
"name": "Safari"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-24213",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24213"
},
{
"cve": "CVE-2025-24223",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-24223"
},
{
"cve": "CVE-2025-31204",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31204"
},
{
"cve": "CVE-2025-31205",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31205"
},
{
"cve": "CVE-2025-31206",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31206"
},
{
"cve": "CVE-2025-31215",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31215"
},
{
"cve": "CVE-2025-31217",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31217"
},
{
"cve": "CVE-2025-31223",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31223"
},
{
"cve": "CVE-2025-31238",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31238"
},
{
"cve": "CVE-2025-31257",
"product_status": {
"known_affected": [
"T043579"
]
},
"release_date": "2025-05-12T22:00:00.000+00:00",
"title": "CVE-2025-31257"
}
]
}
GHSA-FPPM-PF9P-6PH2
Vulnerability from github – Published: 2025-05-13 00:31 – Updated: 2025-11-03 21:33
VLAI?
Details
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
Severity ?
8.0 (High)
{
"affected": [],
"aliases": [
"CVE-2025-31223"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-12T22:15:23Z",
"severity": "HIGH"
},
"details": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.",
"id": "GHSA-fppm-pf9p-6ph2",
"modified": "2025-11-03T21:33:51Z",
"published": "2025-05-13T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31223"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122404"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122716"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122719"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122720"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122721"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122722"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/10"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/13"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/5"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…