Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-43392 (GCVE-0-2025-43392)
Vulnerability from cvelistv5 – Published: 2025-11-04 01:15 – Updated: 2025-12-17 20:46
VLAI?
EPSS
Summary
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. A website may exfiltrate image data cross-origin.
Severity ?
4.3 (Medium)
CWE
- A website may exfiltrate image data cross-origin
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apple | Safari |
Affected:
unspecified , < 26.1
(custom)
|
||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-43392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T16:33:14.602418Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-942",
"description": "CWE-942 Permissive Cross-domain Policy with Untrusted Domains",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T14:45:33.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. A website may exfiltrate image data cross-origin."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A website may exfiltrate image data cross-origin",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T20:46:32.134Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/125640"
},
{
"url": "https://support.apple.com/en-us/125637"
},
{
"url": "https://support.apple.com/en-us/125634"
},
{
"url": "https://support.apple.com/en-us/125638"
},
{
"url": "https://support.apple.com/en-us/125639"
},
{
"url": "https://support.apple.com/en-us/125632"
},
{
"url": "https://support.apple.com/en-us/125633"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2025-43392",
"datePublished": "2025-11-04T01:15:34.041Z",
"dateReserved": "2025-04-16T15:24:37.118Z",
"dateUpdated": "2025-12-17T20:46:32.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-43392\",\"sourceIdentifier\":\"product-security@apple.com\",\"published\":\"2025-11-04T02:15:46.083\",\"lastModified\":\"2025-12-17T21:15:58.143\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. A website may exfiltrate image data cross-origin.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-942\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.1\",\"matchCriteriaId\":\"CFF118CE-3F13-43BE-B250-5579E1C842EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.1\",\"matchCriteriaId\":\"6D51AEDC-9086-4010-B3BF-C652D65D09C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.1\",\"matchCriteriaId\":\"3981A7BE-BC98-4C6F-AE38-D68839368925\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.1\",\"matchCriteriaId\":\"290E0D29-CB5B-45A7-9FE3-FD2030B1D1A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.1\",\"matchCriteriaId\":\"7DFD3616-65CA-4E5C-849C-3C20ACBCB610\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.1\",\"matchCriteriaId\":\"9F9D7F76-13FB-407C-94E5-221B93021568\"}]}]}],\"references\":[{\"url\":\"https://support.apple.com/en-us/125632\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/125633\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/125634\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/125637\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/125638\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/125639\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/125640\",\"source\":\"product-security@apple.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-43392\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-04T16:33:14.602418Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-942\", \"description\": \"CWE-942 Permissive Cross-domain Policy with Untrusted Domains\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-04T16:34:04.830Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Apple\", \"product\": \"Safari\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"26.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"tvOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"26.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"macOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"26.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"visionOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"26.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"watchOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"26.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"iOS and iPadOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"26.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"iOS and iPadOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"18.7\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://support.apple.com/en-us/125640\"}, {\"url\": \"https://support.apple.com/en-us/125637\"}, {\"url\": \"https://support.apple.com/en-us/125634\"}, {\"url\": \"https://support.apple.com/en-us/125638\"}, {\"url\": \"https://support.apple.com/en-us/125639\"}, {\"url\": \"https://support.apple.com/en-us/125632\"}, {\"url\": \"https://support.apple.com/en-us/125633\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. A website may exfiltrate image data cross-origin.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"A website may exfiltrate image data cross-origin\"}]}], \"providerMetadata\": {\"orgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"shortName\": \"apple\", \"dateUpdated\": \"2025-12-17T20:46:32.134Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-43392\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-17T20:46:32.134Z\", \"dateReserved\": \"2025-04-16T15:24:37.118Z\", \"assignerOrgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"datePublished\": \"2025-11-04T01:15:34.041Z\", \"assignerShortName\": \"apple\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
NCSC-2025-0352
Vulnerability from csaf_ncscnl - Published: 2025-11-04 12:53 - Updated: 2025-11-04 12:53Summary
Kwetsbaarheden verholpen in Apple iOS en iPadOS
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Apple heeft kwetsbaarheden verholpen in iOS 26.1 en iPadOS 26.1.
Interpretaties
De kwetsbaarheden betroffen verschillende privacy- en beveiligingsproblemen, waaronder ongeautoriseerde toegang tot gebruikersgegevens, het risico van gegevensexfiltratie, en kwetsbaarheden in geheugenbeheer die konden leiden tot onverwachte systeemcrashes. Aanvallers konden mogelijk gevoelige informatie verkrijgen via misbruik van deze kwetsbaarheden, wat de integriteit en privacy van gebruikers in gevaar bracht. De updates bevatten verbeterde validatiemechanismen en restricties om deze risico's te mitigeren.
Oplossingen
Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
medium
CWE-61
UNIX Symbolic Link (Symlink) Following
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-275
CWE-275
CWE-284
Improper Access Control
CWE-371
CWE-371
CWE-404
Improper Resource Shutdown or Release
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Apple heeft kwetsbaarheden verholpen in iOS 26.1 en iPadOS 26.1.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betroffen verschillende privacy- en beveiligingsproblemen, waaronder ongeautoriseerde toegang tot gebruikersgegevens, het risico van gegevensexfiltratie, en kwetsbaarheden in geheugenbeheer die konden leiden tot onverwachte systeemcrashes. Aanvallers konden mogelijk gevoelige informatie verkrijgen via misbruik van deze kwetsbaarheden, wat de integriteit en privacy van gebruikers in gevaar bracht. De updates bevatten verbeterde validatiemechanismen en restricties om deze risico\u0027s te mitigeren.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "medium",
"title": "Schade"
},
{
"category": "general",
"text": "UNIX Symbolic Link (Symlink) Following",
"title": "CWE-61"
},
{
"category": "general",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CWE-275",
"title": "CWE-275"
},
{
"category": "general",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "CWE-371",
"title": "CWE-371"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://support.apple.com/en-us/125632"
}
],
"title": "Kwetsbaarheden verholpen in Apple iOS en iPadOS",
"tracking": {
"current_release_date": "2025-11-04T12:53:15.358078Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2025-0352",
"initial_release_date": "2025-11-04T12:53:15.358078Z",
"revision_history": [
{
"date": "2025-11-04T12:53:15.358078Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "iOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "iPadOS"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-43442",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 addressed a permissions issue that allowed apps to identify other installed apps by implementing additional restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43442 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43442.json"
}
],
"title": "CVE-2025-43442"
},
{
"cve": "CVE-2025-43455",
"notes": [
{
"category": "description",
"text": "Recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 have resolved a privacy vulnerability that could allow malicious apps to capture sensitive information via screenshots through enhanced checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43455 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43455.json"
}
],
"title": "CVE-2025-43455"
},
{
"cve": "CVE-2025-43447",
"notes": [
{
"category": "description",
"text": "The recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 have resolved issues related to unexpected system termination and kernel memory corruption through enhanced memory handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43447 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43447.json"
}
],
"title": "CVE-2025-43447"
},
{
"cve": "CVE-2025-43462",
"notes": [
{
"category": "description",
"text": "The recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, tvOS 26.1, and visionOS 26.1 have resolved issues related to unexpected system termination and kernel memory corruption through enhanced memory handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43462 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43462.json"
}
],
"title": "CVE-2025-43462"
},
{
"cve": "CVE-2025-43449",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 have resolved the issue of malicious apps tracking users between installs through enhanced cache handling mechanisms.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43449 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43449.json"
}
],
"title": "CVE-2025-43449"
},
{
"cve": "CVE-2025-43379",
"notes": [
{
"category": "description",
"text": "Recent updates in visionOS 26.1 and various macOS, watchOS, iOS, iPadOS, and tvOS versions have enhanced symlink validation to prevent unauthorized access to protected user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43379 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43379.json"
}
],
"title": "CVE-2025-43379"
},
{
"cve": "CVE-2025-43407",
"notes": [
{
"category": "description",
"text": "Recent updates to visionOS 26.1 and various macOS, iOS, and tvOS versions have resolved the issue of apps potentially breaking out of their sandbox through improved entitlements.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43407 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43407.json"
}
],
"title": "CVE-2025-43407"
},
{
"cve": "CVE-2025-43423",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, and visionOS 26.1 have resolved a logging issue that exposed sensitive user information through enhanced data redaction.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43423 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43423.json"
}
],
"title": "CVE-2025-43423"
},
{
"cve": "CVE-2025-43450",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 addressed a logic issue that previously allowed apps to access camera views before permission was granted, enhancing security checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43450 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43450.json"
}
],
"title": "CVE-2025-43450"
},
{
"cve": "CVE-2025-43448",
"notes": [
{
"category": "description",
"text": "Recent updates in visionOS 26.1 and macOS Sonoma 14.8.2 have resolved symlink vulnerabilities through enhanced validation, preventing potential sandbox breaches by applications.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43448 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43448.json"
}
],
"title": "CVE-2025-43448"
},
{
"cve": "CVE-2025-43426",
"notes": [
{
"category": "description",
"text": "A logging issue affecting sensitive user data was resolved in iOS 26.1 and iPadOS 26.1 through enhanced data redaction measures.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43426 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43426.json"
}
],
"title": "CVE-2025-43426"
},
{
"cve": "CVE-2025-43350",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 have resolved a permissions issue that previously allowed unauthorized access to restricted content from the lock screen through enhanced restrictions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43350 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43350.json"
}
],
"title": "CVE-2025-43350"
},
{
"cve": "CVE-2025-43436",
"notes": [
{
"category": "description",
"text": "A permissions issue allowing app enumeration of installed applications has been resolved with enhanced restrictions in watchOS 26.1, iOS 26.1, iPadOS 26.1, tvOS 26.1, and visionOS 26.1.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43436 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43436.json"
}
],
"title": "CVE-2025-43436"
},
{
"cve": "CVE-2025-43445",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability was mitigated through enhanced input validation, impacting multiple operating systems and potentially causing application crashes or memory corruption when handling malicious media files.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43445 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43445.json"
}
],
"title": "CVE-2025-43445"
},
{
"cve": "CVE-2025-43498",
"notes": [
{
"category": "description",
"text": "An authorization issue concerning sensitive user data access has been resolved through enhanced state management in iOS 26.1 and macOS Sequoia 15.7.2.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43498 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43498.json"
}
],
"title": "CVE-2025-43498"
},
{
"cve": "CVE-2025-43507",
"notes": [
{
"category": "description",
"text": "A privacy issue related to user fingerprinting was resolved in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 by relocating sensitive data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43507 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43507.json"
}
],
"title": "CVE-2025-43507"
},
{
"cve": "CVE-2025-43444",
"notes": [
{
"category": "description",
"text": "Recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, tvOS 26.1, and visionOS 26.1 have resolved a permissions issue that could allow apps to fingerprint users through enhanced restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43444 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43444.json"
}
],
"title": "CVE-2025-43444"
},
{
"cve": "CVE-2025-43398",
"notes": [
{
"category": "description",
"text": "Recent updates in visionOS 26.1 and macOS Sonoma 14.8.2 have resolved unexpected system termination issues caused by memory handling through improved memory management techniques.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43398 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43398.json"
}
],
"title": "CVE-2025-43398"
},
{
"cve": "CVE-2025-43413",
"notes": [
{
"category": "description",
"text": "An access issue related to sandbox restrictions has been resolved in visionOS 26.1 and macOS Sonoma 14.8.2, enabling sandboxed apps to observe system-wide network connections through additional restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43413 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43413.json"
}
],
"title": "CVE-2025-43413"
},
{
"cve": "CVE-2025-43496",
"notes": [
{
"category": "description",
"text": "The issue of remote content loading despite the \u0027Load Remote Images\u0027 setting being off has been resolved in watchOS 26.1 and iOS 26.1 through the implementation of additional logic.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43496 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43496.json"
}
],
"title": "CVE-2025-43496"
},
{
"cve": "CVE-2025-43294",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "description",
"text": "The handling of environment variables issue, which posed a risk of unauthorized access to sensitive user data, has been resolved through enhanced validation in watchOS 26.1, iOS 26.1, iPadOS 26.1, and tvOS 26.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43294 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43294.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2025-43294"
},
{
"cve": "CVE-2025-43386",
"notes": [
{
"category": "description",
"text": "iOS 26.1 addressed an out-of-bounds access vulnerability that could lead to app crashes or memory corruption when handling malicious media files, with improved bounds checking implemented.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43386 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43386.json"
}
],
"title": "CVE-2025-43386"
},
{
"cve": "CVE-2025-43385",
"notes": [
{
"category": "description",
"text": "Multiple Apple operating systems addressed an out-of-bounds access issue that could lead to unexpected app termination or memory corruption when handling malicious media files through improved bounds checking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43385 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43385.json"
}
],
"title": "CVE-2025-43385"
},
{
"cve": "CVE-2025-43384",
"notes": [
{
"category": "description",
"text": "Multiple Apple operating systems addressed an out-of-bounds access issue that could lead to unexpected app termination or memory corruption when handling malicious media files through improved bounds checking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43384 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43384.json"
}
],
"title": "CVE-2025-43384"
},
{
"cve": "CVE-2025-43383",
"notes": [
{
"category": "description",
"text": "Multiple Apple operating systems addressed an out-of-bounds access issue that could lead to unexpected app termination or memory corruption when handling malicious media files through improved bounds checking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43383 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43383.json"
}
],
"title": "CVE-2025-43383"
},
{
"cve": "CVE-2025-43424",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 have resolved a potential process crash vulnerability caused by a malicious HID device through the implementation of improved bounds checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43424 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43424.json"
}
],
"title": "CVE-2025-43424"
},
{
"cve": "CVE-2025-43389",
"notes": [
{
"category": "description",
"text": "A privacy vulnerability in iOS 26.1 and macOS Sequoia 15.7.2 was resolved by removing code that could have allowed unauthorized access to sensitive user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43389 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43389.json"
}
],
"title": "CVE-2025-43389"
},
{
"cve": "CVE-2025-43439",
"notes": [
{
"category": "description",
"text": "Recent updates in iOS 26.1, iPadOS 26.1, and visionOS 26.1 addressed a privacy issue by eliminating sensitive data that could facilitate user fingerprinting.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43439 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43439.json"
}
],
"title": "CVE-2025-43439"
},
{
"cve": "CVE-2025-43391",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, macOS Sonoma 14.8.2, and macOS Sequoia 15.7.2 have resolved a privacy issue related to the handling of temporary files that could have allowed unauthorized access to sensitive user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43391 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43391.json"
}
],
"title": "CVE-2025-43391"
},
{
"cve": "CVE-2025-43493",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1 have resolved the address bar spoofing issue through enhanced verification measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43493 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43493.json"
}
],
"title": "CVE-2025-43493"
},
{
"cve": "CVE-2025-43503",
"notes": [
{
"category": "description",
"text": "An inconsistent user interface issue related to state management has been resolved across multiple operating systems, including watchOS, iOS, iPadOS, Safari, and visionOS, addressing potential spoofing risks from malicious websites.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43503 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43503.json"
}
],
"title": "CVE-2025-43503"
},
{
"cve": "CVE-2025-43502",
"notes": [
{
"category": "description",
"text": "Recent updates in iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1 addressed a privacy issue by removing sensitive data to prevent the bypassing of privacy preferences.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43502 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43502.json"
}
],
"title": "CVE-2025-43502"
},
{
"cve": "CVE-2025-43500",
"notes": [
{
"category": "description",
"text": "Recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 have resolved a privacy issue regarding user preferences, enhancing the protection of sensitive user data from app access.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43500 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43500.json"
}
],
"title": "CVE-2025-43500"
},
{
"cve": "CVE-2025-43454",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 resolve device locking failures and improve bounds checks, enhancing overall system stability.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43454 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43454.json"
}
],
"title": "CVE-2025-43454"
},
{
"cve": "CVE-2025-43460",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 have addressed a logic issue that allowed physical access to a locked device, enabling the viewing of sensitive user information, through enhanced checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43460 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43460.json"
}
],
"title": "CVE-2025-43460"
},
{
"cve": "CVE-2025-43422",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 have addressed a vulnerability in Stolen Device Protection that could be exploited by an attacker with physical access, through the implementation of additional logic.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43422 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43422.json"
}
],
"title": "CVE-2025-43422"
},
{
"cve": "CVE-2025-43452",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 have resolved the issue of keyboard suggestions displaying sensitive information on the lock screen by implementing restrictions on options available on locked devices.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43452 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43452.json"
}
],
"title": "CVE-2025-43452"
},
{
"cve": "CVE-2025-43480",
"notes": [
{
"category": "description",
"text": "Apple has resolved a data exfiltration issue in Safari and iOS through enhanced checks to prevent potential threats from malicious websites.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43480 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43480.json"
}
],
"title": "CVE-2025-43480"
},
{
"cve": "CVE-2025-43458",
"notes": [
{
"category": "description",
"text": "Apple has resolved the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43458 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43458.json"
}
],
"title": "CVE-2025-43458"
},
{
"cve": "CVE-2025-43430",
"notes": [
{
"category": "description",
"text": "Apple has resolved the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43430 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43430.json"
}
],
"title": "CVE-2025-43430"
},
{
"cve": "CVE-2025-43427",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, tvOS 26.1, Safari 26.1, and visionOS 26.1 have resolved unexpected process crashes caused by malicious web content through enhanced state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43427 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43427.json"
}
],
"title": "CVE-2025-43427"
},
{
"cve": "CVE-2025-43443",
"notes": [
{
"category": "description",
"text": "Safari 26.1 and various Apple operating systems have resolved unexpected process crashes caused by malicious web content through enhanced checks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43443 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43443.json"
}
],
"title": "CVE-2025-43443"
},
{
"cve": "CVE-2025-43441",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, tvOS 26.1, Safari 26.1, and visionOS 26.1 have addressed unexpected process crashes caused by malicious web content through enhanced memory management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43441 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43441.json"
}
],
"title": "CVE-2025-43441"
},
{
"cve": "CVE-2025-43435",
"notes": [
{
"category": "description",
"text": "Apple has addressed the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43435 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43435.json"
}
],
"title": "CVE-2025-43435"
},
{
"cve": "CVE-2025-43425",
"notes": [
{
"category": "description",
"text": "Apple has addressed the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43425 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43425.json"
}
],
"title": "CVE-2025-43425"
},
{
"cve": "CVE-2025-43440",
"notes": [
{
"category": "description",
"text": "Safari 26.1 and various Apple operating systems have resolved unexpected process crashes caused by malicious web content through enhanced verification measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43440 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43440.json"
}
],
"title": "CVE-2025-43440"
},
{
"cve": "CVE-2025-43438",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability affecting Safari and various Apple operating systems was addressed through improved memory management in the latest updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43438 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43438.json"
}
],
"title": "CVE-2025-43438"
},
{
"cve": "CVE-2025-43457",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability affecting Safari and various Apple operating systems was addressed through improved memory management in the latest updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43457 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43457.json"
}
],
"title": "CVE-2025-43457"
},
{
"cve": "CVE-2025-43434",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability affecting Safari and various Apple operating systems was addressed through improved memory management in the latest updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43434 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43434.json"
}
],
"title": "CVE-2025-43434"
},
{
"cve": "CVE-2025-43495",
"notes": [
{
"category": "description",
"text": "The issue of unauthorized keystroke monitoring has been addressed in iOS 26.1 and iPadOS 26.1 through the implementation of improved checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43495 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43495.json"
}
],
"title": "CVE-2025-43495"
},
{
"cve": "CVE-2025-43433",
"notes": [
{
"category": "description",
"text": "Apple has addressed memory corruption vulnerabilities in Safari and iOS 26.1 through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43433 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43433.json"
}
],
"title": "CVE-2025-43433"
},
{
"cve": "CVE-2025-43431",
"notes": [
{
"category": "description",
"text": "Apple has addressed memory corruption vulnerabilities in Safari and iOS 26.1 through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43431 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43431.json"
}
],
"title": "CVE-2025-43431"
},
{
"cve": "CVE-2025-43432",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability in various Apple operating systems was resolved through improved memory management, mitigating risks from potentially malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43432 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43432.json"
}
],
"title": "CVE-2025-43432"
},
{
"cve": "CVE-2025-43429",
"notes": [
{
"category": "description",
"text": "A buffer overflow vulnerability was addressed in Safari and various Apple operating systems, including visionOS, watchOS, iOS, iPadOS, and tvOS versions 26.1, through enhanced bounds checking to prevent unexpected process crashes from malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43429 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43429.json"
}
],
"title": "CVE-2025-43429"
},
{
"cve": "CVE-2025-43421",
"notes": [
{
"category": "description",
"text": "Disabling array allocation sinking has resolved vulnerabilities in iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1, preventing unexpected process crashes from malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43421 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43421.json"
}
],
"title": "CVE-2025-43421"
},
{
"cve": "CVE-2025-43392",
"notes": [
{
"category": "description",
"text": "Safari 26.1 and related operating systems have resolved cross-origin image data exfiltration issues through improved cache handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43392 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43392.json"
}
],
"title": "CVE-2025-43392"
}
]
}
NCSC-2025-0351
Vulnerability from csaf_ncscnl - Published: 2025-11-04 12:44 - Updated: 2025-11-04 12:44Summary
Kwetsbaarheden verholpen in Apple MacOS
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Apple heeft kwetsbaarheden verholpen in macOS Sonoma 14.8.2, macOS Sequoia 15.7.2 en MacOS Tahoe 26.1.
Interpretaties
De kwetsbaarheden omvatten een breed scala aan problemen, waaronder ongeautoriseerde toegang tot gevoelige gebruikersdata, racecondities, en logische fouten die konden leiden tot ongewenste toegang of systeeminstabiliteit. Aanvallers konden deze kwetsbaarheden misbruiken door gebruik te maken van onjuiste validatieprocessen en beveiligingslekken in de sandbox-omgeving. De impact varieerde van gegevenslekken tot potentiële systeemcrashes, wat de noodzaak van onmiddellijke aandacht benadrukte.
Oplossingen
Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen, waaronder verbeterde validatieprocessen, extra restricties in de sandbox-omgeving, en verbeteringen in het geheugenbeheer. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-20
Improper Input Validation
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-61
UNIX Symbolic Link (Symlink) Following
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-265
CWE-265
CWE-275
CWE-275
CWE-276
Incorrect Default Permissions
CWE-284
Improper Access Control
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-404
Improper Resource Shutdown or Release
CWE-416
Use After Free
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-532
Insertion of Sensitive Information into Log File
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-863
Incorrect Authorization
CWE-1333
Inefficient Regular Expression Complexity
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Apple heeft kwetsbaarheden verholpen in macOS Sonoma 14.8.2, macOS Sequoia 15.7.2 en MacOS Tahoe 26.1.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden omvatten een breed scala aan problemen, waaronder ongeautoriseerde toegang tot gevoelige gebruikersdata, racecondities, en logische fouten die konden leiden tot ongewenste toegang of systeeminstabiliteit. Aanvallers konden deze kwetsbaarheden misbruiken door gebruik te maken van onjuiste validatieprocessen en beveiligingslekken in de sandbox-omgeving. De impact varieerde van gegevenslekken tot potenti\u00eble systeemcrashes, wat de noodzaak van onmiddellijke aandacht benadrukte.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen, waaronder verbeterde validatieprocessen, extra restricties in de sandbox-omgeving, en verbeteringen in het geheugenbeheer. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "UNIX Symbolic Link (Symlink) Following",
"title": "CWE-61"
},
{
"category": "general",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "general",
"text": "CWE-265",
"title": "CWE-265"
},
{
"category": "general",
"text": "CWE-275",
"title": "CWE-275"
},
{
"category": "general",
"text": "Incorrect Default Permissions",
"title": "CWE-276"
},
{
"category": "general",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"title": "CWE-444"
},
{
"category": "general",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "general",
"text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)",
"title": "CWE-776"
},
{
"category": "general",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "general",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://support.apple.com/en-us/125634"
},
{
"category": "external",
"summary": "Reference",
"url": "https://support.apple.com/en-us/125635"
},
{
"category": "external",
"summary": "Reference",
"url": "https://support.apple.com/en-us/125636"
}
],
"title": "Kwetsbaarheden verholpen in Apple MacOS",
"tracking": {
"current_release_date": "2025-11-04T12:44:25.439757Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2025-0351",
"initial_release_date": "2025-11-04T12:44:25.439757Z",
"revision_history": [
{
"date": "2025-11-04T12:44:25.439757Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "macOS Sequoia"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "macOS Sonoma"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "macOS Tahoe"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-43398",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)",
"title": "CWE-776"
},
{
"category": "description",
"text": "The REXML gem has multiple denial of service vulnerabilities, particularly affecting versions prior to 3.3.6, with updates addressing these issues in version 3.3.9.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-43398 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-43398.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2024-43398"
},
{
"cve": "CVE-2024-49761",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "description",
"text": "REXML gem versions prior to 3.3.9 have a ReDoS vulnerability affecting Ruby 3.1 and earlier, with patches available in newer versions, while ruby2.5 also addresses related vulnerabilities in WEBrick and URI handling.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-49761 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-49761.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2024-49761"
},
{
"cve": "CVE-2025-6442",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"notes": [
{
"category": "other",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"title": "CWE-444"
},
{
"category": "description",
"text": "The Ruby WEBrick read_header HTTP Request Smuggling Vulnerability (CVE-2025-6442) allows remote attackers to exploit affected installations behind specific HTTP proxies, alongside userinfo leakage issues (CVE-2025-27221).",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-6442 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-6442.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-6442"
},
{
"cve": "CVE-2025-30465",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "other",
"text": "Incorrect Default Permissions",
"title": "CWE-276"
},
{
"category": "description",
"text": "A permissions issue in macOS and iPadOS that allowed shortcuts to access restricted files has been resolved through enhanced validation measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-30465 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-30465.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-30465"
},
{
"cve": "CVE-2025-31199",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "description",
"text": "A logging issue allowing app access to sensitive user data has been resolved through enhanced data redaction in iOS 18.4, iPadOS 18.4, visionOS 2.4, and macOS Sequoia 15.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-31199 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-31199.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-31199"
},
{
"cve": "CVE-2025-32462",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "A privilege escalation vulnerability in Sudo affects versions 1.8.8 to 1.9.17, allowing unauthorized users to gain elevated privileges through misconfigured sudoers files, particularly in shared environments.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-32462 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-32462.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-32462"
},
{
"cve": "CVE-2025-43292",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "other",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "description",
"text": "macOS Sequoia 15.7 and 15.7.2 have addressed a race condition that could allow unauthorized access to sensitive user data through enhanced state handling mechanisms.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43292 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43292.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-43292"
},
{
"cve": "CVE-2025-43322",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a logic issue that could allow unauthorized access to user-sensitive data through enhanced checks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43322 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43322.json"
}
],
"title": "CVE-2025-43322"
},
{
"cve": "CVE-2025-43334",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved unauthorized access to user-sensitive data through the implementation of additional entitlement checks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43334 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43334.json"
}
],
"title": "CVE-2025-43334"
},
{
"cve": "CVE-2025-43335",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved unauthorized access to user-sensitive data by implementing additional logic.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43335 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43335.json"
}
],
"title": "CVE-2025-43335"
},
{
"cve": "CVE-2025-43336",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a permissions issue that allowed root-privileged apps to access private information through additional restrictions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43336 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43336.json"
}
],
"title": "CVE-2025-43336"
},
{
"cve": "CVE-2025-43337",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "description",
"text": "macOS Sequoia 15.7.2 has addressed an access issue related to sensitive user data by implementing additional sandbox restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43337 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43337.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-43337"
},
{
"cve": "CVE-2025-43338",
"notes": [
{
"category": "description",
"text": "An out-of-bounds access vulnerability affecting macOS Sonoma 14.8.2, iOS 26, and iPadOS 26 was fixed, which could lead to unexpected app termination or memory corruption when handling malicious media files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43338 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43338.json"
}
],
"title": "CVE-2025-43338"
},
{
"cve": "CVE-2025-43348",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a logic issue that allowed apps to bypass Gatekeeper checks through improved validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43348 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43348.json"
}
],
"title": "CVE-2025-43348"
},
{
"cve": "CVE-2025-43351",
"notes": [
{
"category": "description",
"text": "A permissions issue was addressed through the implementation of additional restrictions to enhance security controls.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43351 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43351.json"
}
],
"title": "CVE-2025-43351"
},
{
"cve": "CVE-2025-43361",
"notes": [
{
"category": "description",
"text": "Apple has addressed an out-of-bounds read vulnerability in multiple operating systems through enhanced bounds checking, preventing potential access to kernel memory by malicious applications.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43361 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43361.json"
}
],
"title": "CVE-2025-43361"
},
{
"cve": "CVE-2025-43364",
"notes": [
{
"category": "description",
"text": "A race condition that could allow an application to escape its sandbox has been addressed in macOS Sonoma 14.8 and macOS Sequoia 15.7 through enhanced validation measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43364 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43364.json"
}
],
"title": "CVE-2025-43364"
},
{
"cve": "CVE-2025-43372",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "description",
"text": "Recent updates in tvOS 26 and iOS 26 have addressed a vulnerability related to potential app termination or memory corruption caused by malicious media files through enhanced input validation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43372 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43372.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-43372"
},
{
"cve": "CVE-2025-43373",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed issues related to unexpected system termination and kernel memory corruption through improved memory handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43373 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43373.json"
}
],
"title": "CVE-2025-43373"
},
{
"cve": "CVE-2025-43377",
"notes": [
{
"category": "description",
"text": "macOS Sequoia 15.7.2 addressed an out-of-bounds read vulnerability through enhanced bounds checking, which could lead to potential denial-of-service by an application.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43377 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43377.json"
}
],
"title": "CVE-2025-43377"
},
{
"cve": "CVE-2025-43378",
"notes": [
{
"category": "description",
"text": "macOS Sequoia 15.7.2 has resolved a permissions issue that previously allowed unauthorized access to sensitive user data by implementing additional restrictions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43378 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43378.json"
}
],
"title": "CVE-2025-43378"
},
{
"cve": "CVE-2025-43379",
"notes": [
{
"category": "description",
"text": "Recent updates in visionOS 26.1 and various macOS, watchOS, iOS, iPadOS, and tvOS versions have enhanced symlink validation to prevent unauthorized access to protected user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43379 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43379.json"
}
],
"title": "CVE-2025-43379"
},
{
"cve": "CVE-2025-43380",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed an out-of-bounds write vulnerability that could lead to unexpected application termination through improved input validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43380 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43380.json"
}
],
"title": "CVE-2025-43380"
},
{
"cve": "CVE-2025-43381",
"notes": [
{
"category": "description",
"text": "The issue was addressed by improving the management of symlinks to enhance system integrity and security.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43381 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43381.json"
}
],
"title": "CVE-2025-43381"
},
{
"cve": "CVE-2025-43382",
"notes": [
{
"category": "description",
"text": "Recent updates in macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 addressed a parsing issue in directory path handling, enhancing path validation to prevent potential unauthorized access to sensitive user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43382 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43382.json"
}
],
"title": "CVE-2025-43382"
},
{
"cve": "CVE-2025-43383",
"notes": [
{
"category": "description",
"text": "Multiple Apple operating systems addressed an out-of-bounds access issue that could lead to unexpected app termination or memory corruption when handling malicious media files through improved bounds checking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43383 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43383.json"
}
],
"title": "CVE-2025-43383"
},
{
"cve": "CVE-2025-43384",
"notes": [
{
"category": "description",
"text": "Multiple Apple operating systems addressed an out-of-bounds access issue that could lead to unexpected app termination or memory corruption when handling malicious media files through improved bounds checking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43384 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43384.json"
}
],
"title": "CVE-2025-43384"
},
{
"cve": "CVE-2025-43385",
"notes": [
{
"category": "description",
"text": "Multiple Apple operating systems addressed an out-of-bounds access issue that could lead to unexpected app termination or memory corruption when handling malicious media files through improved bounds checking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43385 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43385.json"
}
],
"title": "CVE-2025-43385"
},
{
"cve": "CVE-2025-43386",
"notes": [
{
"category": "description",
"text": "iOS 26.1 addressed an out-of-bounds access vulnerability that could lead to app crashes or memory corruption when handling malicious media files, with improved bounds checking implemented.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43386 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43386.json"
}
],
"title": "CVE-2025-43386"
},
{
"cve": "CVE-2025-43387",
"notes": [
{
"category": "description",
"text": "macOS Sequoia 15.7.2 has addressed a permissions issue that could allow malicious applications to gain root privileges through the implementation of additional restrictions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43387 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43387.json"
}
],
"title": "CVE-2025-43387"
},
{
"cve": "CVE-2025-43388",
"notes": [
{
"category": "description",
"text": "An injection vulnerability was effectively mitigated through the implementation of enhanced validation measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43388 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43388.json"
}
],
"title": "CVE-2025-43388"
},
{
"cve": "CVE-2025-43389",
"notes": [
{
"category": "description",
"text": "A privacy vulnerability in iOS 26.1 and macOS Sequoia 15.7.2 was resolved by removing code that could have allowed unauthorized access to sensitive user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43389 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43389.json"
}
],
"title": "CVE-2025-43389"
},
{
"cve": "CVE-2025-43390",
"notes": [
{
"category": "description",
"text": "macOS Sequoia 15.7.2 resolves a downgrade issue on Intel-based Mac computers by implementing enhanced code-signing restrictions to protect user-sensitive data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43390 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43390.json"
}
],
"title": "CVE-2025-43390"
},
{
"cve": "CVE-2025-43391",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, macOS Sonoma 14.8.2, and macOS Sequoia 15.7.2 have resolved a privacy issue related to the handling of temporary files that could have allowed unauthorized access to sensitive user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43391 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43391.json"
}
],
"title": "CVE-2025-43391"
},
{
"cve": "CVE-2025-43392",
"notes": [
{
"category": "description",
"text": "Safari 26.1 and related operating systems have resolved cross-origin image data exfiltration issues through improved cache handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43392 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43392.json"
}
],
"title": "CVE-2025-43392"
},
{
"cve": "CVE-2025-43393",
"notes": [
{
"category": "description",
"text": "A permissions issue was addressed by enhancing restrictions within the sandbox environment to improve security controls.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43393 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43393.json"
}
],
"title": "CVE-2025-43393"
},
{
"cve": "CVE-2025-43394",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved an issue related to the handling of symlinks that previously allowed applications to access protected user data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43394 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43394.json"
}
],
"title": "CVE-2025-43394"
},
{
"cve": "CVE-2025-43395",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved an issue related to the handling of symlinks that previously allowed applications to access protected user data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43395 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43395.json"
}
],
"title": "CVE-2025-43395"
},
{
"cve": "CVE-2025-43396",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a logic issue that could allow sandboxed apps to access sensitive user data through enhanced checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43396 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43396.json"
}
],
"title": "CVE-2025-43396"
},
{
"cve": "CVE-2025-43397",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 addressed a permissions vulnerability that could lead to denial-of-service by removing the associated vulnerable code.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43397 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43397.json"
}
],
"title": "CVE-2025-43397"
},
{
"cve": "CVE-2025-43398",
"notes": [
{
"category": "description",
"text": "Recent updates in visionOS 26.1 and macOS Sonoma 14.8.2 have resolved unexpected system termination issues caused by memory handling through improved memory management techniques.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43398 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43398.json"
}
],
"title": "CVE-2025-43398"
},
{
"cve": "CVE-2025-43399",
"notes": [
{
"category": "description",
"text": "macOS Sequoia 15.7.2 has addressed unauthorized access to protected user data through enhanced redaction measures, significantly reducing the risk of sensitive information exposure.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43399 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43399.json"
}
],
"title": "CVE-2025-43399"
},
{
"cve": "CVE-2025-43401",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 addressed a denial-of-service vulnerability through enhanced validation, preventing potential exploitation by remote attackers.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43401 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43401.json"
}
],
"title": "CVE-2025-43401"
},
{
"cve": "CVE-2025-43402",
"notes": [
{
"category": "description",
"text": "The issue was addressed through improvements in memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43402 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43402.json"
}
],
"title": "CVE-2025-43402"
},
{
"cve": "CVE-2025-43404",
"notes": [
{
"category": "description",
"text": "A permissions issue was addressed by enhancing restrictions within the sandbox environment to improve security controls.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43404 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43404.json"
}
],
"title": "CVE-2025-43404"
},
{
"cve": "CVE-2025-43405",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 addressed a permissions issue related to user-sensitive data through enhanced sandbox restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43405 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43405.json"
}
],
"title": "CVE-2025-43405"
},
{
"cve": "CVE-2025-43406",
"notes": [
{
"category": "description",
"text": "A logic issue was resolved through the implementation of enhanced restrictions, improving system integrity and security.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43406 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43406.json"
}
],
"title": "CVE-2025-43406"
},
{
"cve": "CVE-2025-43407",
"notes": [
{
"category": "description",
"text": "Recent updates to visionOS 26.1 and various macOS, iOS, and tvOS versions have resolved the issue of apps potentially breaking out of their sandbox through improved entitlements.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43407 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43407.json"
}
],
"title": "CVE-2025-43407"
},
{
"cve": "CVE-2025-43408",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved unauthorized access to contacts from the lock screen by restricting available options, enhancing device security.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43408 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43408.json"
}
],
"title": "CVE-2025-43408"
},
{
"cve": "CVE-2025-43409",
"notes": [
{
"category": "description",
"text": "macOS Sequoia 15.7.2 addressed a permissions issue that allowed applications to access sensitive user data by implementing additional sandbox restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43409 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43409.json"
}
],
"title": "CVE-2025-43409"
},
{
"cve": "CVE-2025-43411",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved unauthorized access to user-sensitive data through the implementation of additional entitlement checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43411 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43411.json"
}
],
"title": "CVE-2025-43411"
},
{
"cve": "CVE-2025-43412",
"notes": [
{
"category": "description",
"text": "The file quarantine bypass issue, which allowed applications to escape their sandbox, has been resolved in macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 through the implementation of additional checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43412 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43412.json"
}
],
"title": "CVE-2025-43412"
},
{
"cve": "CVE-2025-43413",
"notes": [
{
"category": "description",
"text": "An access issue related to sandbox restrictions has been resolved in visionOS 26.1 and macOS Sonoma 14.8.2, enabling sandboxed apps to observe system-wide network connections through additional restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43413 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43413.json"
}
],
"title": "CVE-2025-43413"
},
{
"cve": "CVE-2025-43414",
"notes": [
{
"category": "description",
"text": "Recent updates in macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 addressed a permissions issue through enhanced validation, potentially allowing shortcuts to access restricted files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43414 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43414.json"
}
],
"title": "CVE-2025-43414"
},
{
"cve": "CVE-2025-43420",
"notes": [
{
"category": "description",
"text": "A race condition vulnerability was resolved in macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2, enhancing state handling to prevent unauthorized access to sensitive user data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43420 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43420.json"
}
],
"title": "CVE-2025-43420"
},
{
"cve": "CVE-2025-43421",
"notes": [
{
"category": "description",
"text": "Disabling array allocation sinking has resolved vulnerabilities in iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1, preventing unexpected process crashes from malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43421 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43421.json"
}
],
"title": "CVE-2025-43421"
},
{
"cve": "CVE-2025-43423",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, and visionOS 26.1 have resolved a logging issue that exposed sensitive user information through enhanced data redaction.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43423 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43423.json"
}
],
"title": "CVE-2025-43423"
},
{
"cve": "CVE-2025-43424",
"notes": [
{
"category": "description",
"text": "iOS 26.1 and iPadOS 26.1 have resolved a potential process crash vulnerability caused by a malicious HID device through the implementation of improved bounds checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43424 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43424.json"
}
],
"title": "CVE-2025-43424"
},
{
"cve": "CVE-2025-43425",
"notes": [
{
"category": "description",
"text": "Apple has addressed the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43425 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43425.json"
}
],
"title": "CVE-2025-43425"
},
{
"cve": "CVE-2025-43426",
"notes": [
{
"category": "description",
"text": "A logging issue affecting sensitive user data was resolved in iOS 26.1 and iPadOS 26.1 through enhanced data redaction measures.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43426 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43426.json"
}
],
"title": "CVE-2025-43426"
},
{
"cve": "CVE-2025-43427",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, tvOS 26.1, Safari 26.1, and visionOS 26.1 have resolved unexpected process crashes caused by malicious web content through enhanced state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43427 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43427.json"
}
],
"title": "CVE-2025-43427"
},
{
"cve": "CVE-2025-43429",
"notes": [
{
"category": "description",
"text": "A buffer overflow vulnerability was addressed in Safari and various Apple operating systems, including visionOS, watchOS, iOS, iPadOS, and tvOS versions 26.1, through enhanced bounds checking to prevent unexpected process crashes from malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43429 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43429.json"
}
],
"title": "CVE-2025-43429"
},
{
"cve": "CVE-2025-43430",
"notes": [
{
"category": "description",
"text": "Apple has resolved the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43430 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43430.json"
}
],
"title": "CVE-2025-43430"
},
{
"cve": "CVE-2025-43431",
"notes": [
{
"category": "description",
"text": "Apple has addressed memory corruption vulnerabilities in Safari and iOS 26.1 through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43431 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43431.json"
}
],
"title": "CVE-2025-43431"
},
{
"cve": "CVE-2025-43432",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability in various Apple operating systems was resolved through improved memory management, mitigating risks from potentially malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43432 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43432.json"
}
],
"title": "CVE-2025-43432"
},
{
"cve": "CVE-2025-43433",
"notes": [
{
"category": "description",
"text": "Apple has addressed memory corruption vulnerabilities in Safari and iOS 26.1 through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43433 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43433.json"
}
],
"title": "CVE-2025-43433"
},
{
"cve": "CVE-2025-43434",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability affecting Safari and various Apple operating systems was addressed through improved memory management in the latest updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43434 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43434.json"
}
],
"title": "CVE-2025-43434"
},
{
"cve": "CVE-2025-43435",
"notes": [
{
"category": "description",
"text": "Apple has addressed the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced memory management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43435 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43435.json"
}
],
"title": "CVE-2025-43435"
},
{
"cve": "CVE-2025-43436",
"notes": [
{
"category": "description",
"text": "A permissions issue allowing app enumeration of installed applications has been resolved with enhanced restrictions in watchOS 26.1, iOS 26.1, iPadOS 26.1, tvOS 26.1, and visionOS 26.1.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43436 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43436.json"
}
],
"title": "CVE-2025-43436"
},
{
"cve": "CVE-2025-43438",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability affecting Safari and various Apple operating systems was addressed through improved memory management in the latest updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43438 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43438.json"
}
],
"title": "CVE-2025-43438"
},
{
"cve": "CVE-2025-43440",
"notes": [
{
"category": "description",
"text": "Safari 26.1 and various Apple operating systems have resolved unexpected process crashes caused by malicious web content through enhanced verification measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43440 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43440.json"
}
],
"title": "CVE-2025-43440"
},
{
"cve": "CVE-2025-43441",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, tvOS 26.1, Safari 26.1, and visionOS 26.1 have addressed unexpected process crashes caused by malicious web content through enhanced memory management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43441 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43441.json"
}
],
"title": "CVE-2025-43441"
},
{
"cve": "CVE-2025-43443",
"notes": [
{
"category": "description",
"text": "Safari 26.1 and various Apple operating systems have resolved unexpected process crashes caused by malicious web content through enhanced checks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43443 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43443.json"
}
],
"title": "CVE-2025-43443"
},
{
"cve": "CVE-2025-43444",
"notes": [
{
"category": "description",
"text": "Recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, tvOS 26.1, and visionOS 26.1 have resolved a permissions issue that could allow apps to fingerprint users through enhanced restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43444 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43444.json"
}
],
"title": "CVE-2025-43444"
},
{
"cve": "CVE-2025-43445",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability was mitigated through enhanced input validation, impacting multiple operating systems and potentially causing application crashes or memory corruption when handling malicious media files.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43445 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43445.json"
}
],
"title": "CVE-2025-43445"
},
{
"cve": "CVE-2025-43446",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved the issue of apps modifying protected file system areas through enhanced symlink validation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43446 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43446.json"
}
],
"title": "CVE-2025-43446"
},
{
"cve": "CVE-2025-43447",
"notes": [
{
"category": "description",
"text": "The recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 have resolved issues related to unexpected system termination and kernel memory corruption through enhanced memory handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43447 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43447.json"
}
],
"title": "CVE-2025-43447"
},
{
"cve": "CVE-2025-43448",
"notes": [
{
"category": "description",
"text": "Recent updates in visionOS 26.1 and macOS Sonoma 14.8.2 have resolved symlink vulnerabilities through enhanced validation, preventing potential sandbox breaches by applications.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43448 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43448.json"
}
],
"title": "CVE-2025-43448"
},
{
"cve": "CVE-2025-43455",
"notes": [
{
"category": "description",
"text": "Recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 have resolved a privacy vulnerability that could allow malicious apps to capture sensitive information via screenshots through enhanced checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43455 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43455.json"
}
],
"title": "CVE-2025-43455"
},
{
"cve": "CVE-2025-43457",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability affecting Safari and various Apple operating systems was addressed through improved memory management in the latest updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43457 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43457.json"
}
],
"title": "CVE-2025-43457"
},
{
"cve": "CVE-2025-43458",
"notes": [
{
"category": "description",
"text": "Apple has resolved the issue of unexpected process crashes in Safari and iOS caused by malicious web content through enhanced state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43458 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43458.json"
}
],
"title": "CVE-2025-43458"
},
{
"cve": "CVE-2025-43461",
"notes": [
{
"category": "description",
"text": "The issue was addressed by improving the symlink validation process to enhance security measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43461 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43461.json"
}
],
"title": "CVE-2025-43461"
},
{
"cve": "CVE-2025-43462",
"notes": [
{
"category": "description",
"text": "The recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, tvOS 26.1, and visionOS 26.1 have resolved issues related to unexpected system termination and kernel memory corruption through enhanced memory handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43462 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43462.json"
}
],
"title": "CVE-2025-43462"
},
{
"cve": "CVE-2025-43463",
"notes": [
{
"category": "description",
"text": "A parsing issue concerning directory paths was effectively addressed through improved path validation mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43463 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43463.json"
}
],
"title": "CVE-2025-43463"
},
{
"cve": "CVE-2025-43464",
"notes": [
{
"category": "description",
"text": "A denial-of-service vulnerability was addressed through improved input validation techniques, enhancing the overall security posture.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43464 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43464.json"
}
],
"title": "CVE-2025-43464"
},
{
"cve": "CVE-2025-43465",
"notes": [
{
"category": "description",
"text": "A parsing issue concerning directory paths was effectively addressed through improved path validation mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43465 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43465.json"
}
],
"title": "CVE-2025-43465"
},
{
"cve": "CVE-2025-43466",
"notes": [
{
"category": "description",
"text": "An injection vulnerability was effectively mitigated through the implementation of enhanced validation measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43466 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43466.json"
}
],
"title": "CVE-2025-43466"
},
{
"cve": "CVE-2025-43467",
"notes": [
{
"category": "description",
"text": "The issue was resolved through the implementation of enhanced checks, ensuring improved security measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43467 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43467.json"
}
],
"title": "CVE-2025-43467"
},
{
"cve": "CVE-2025-43468",
"notes": [
{
"category": "description",
"text": "New code-signing restrictions in macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved a downgrade issue on Intel-based Mac computers that previously allowed unauthorized access to sensitive user data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43468 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43468.json"
}
],
"title": "CVE-2025-43468"
},
{
"cve": "CVE-2025-43469",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a permissions issue that previously allowed applications to access sensitive user data by implementing additional restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43469 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43469.json"
}
],
"title": "CVE-2025-43469"
},
{
"cve": "CVE-2025-43471",
"notes": [
{
"category": "description",
"text": "The issue was resolved through the implementation of enhanced checks, ensuring improved security measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43471 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43471.json"
}
],
"title": "CVE-2025-43471"
},
{
"cve": "CVE-2025-43472",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a validation issue related to input sanitization that could have allowed applications to gain root privileges.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43472 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43472.json"
}
],
"title": "CVE-2025-43472"
},
{
"cve": "CVE-2025-43473",
"notes": [
{
"category": "description",
"text": "The issue was effectively resolved through the implementation of enhanced state management techniques.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43473 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43473.json"
}
],
"title": "CVE-2025-43473"
},
{
"cve": "CVE-2025-43474",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved an out-of-bounds read issue that could lead to system termination or unauthorized kernel memory access through enhanced input validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43474 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43474.json"
}
],
"title": "CVE-2025-43474"
},
{
"cve": "CVE-2025-43476",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a permissions issue that could allow an app to escape its sandbox through the implementation of additional restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43476 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43476.json"
}
],
"title": "CVE-2025-43476"
},
{
"cve": "CVE-2025-43477",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved a privacy issue concerning sensitive user data access through enhanced private data redaction for both user data and log entries.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43477 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43477.json"
}
],
"title": "CVE-2025-43477"
},
{
"cve": "CVE-2025-43478",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a use after free issue related to memory management, preventing unexpected app-related system terminations.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43478 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43478.json"
}
],
"title": "CVE-2025-43478"
},
{
"cve": "CVE-2025-43479",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have addressed a permissions issue that previously allowed applications to access sensitive user data by implementing additional restrictions.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43479 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43479.json"
}
],
"title": "CVE-2025-43479"
},
{
"cve": "CVE-2025-43480",
"notes": [
{
"category": "description",
"text": "Apple has resolved a data exfiltration issue in Safari and iOS through enhanced checks to prevent potential threats from malicious websites.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43480 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43480.json"
}
],
"title": "CVE-2025-43480"
},
{
"cve": "CVE-2025-43481",
"notes": [
{
"category": "description",
"text": "macOS Sequoia 15.7.2 has resolved the issue of applications potentially escaping their sandbox through enhanced verification measures.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43481 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43481.json"
}
],
"title": "CVE-2025-43481"
},
{
"cve": "CVE-2025-43493",
"notes": [
{
"category": "description",
"text": "iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1 have resolved the address bar spoofing issue through enhanced verification measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43493 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43493.json"
}
],
"title": "CVE-2025-43493"
},
{
"cve": "CVE-2025-43496",
"notes": [
{
"category": "description",
"text": "The issue of remote content loading despite the \u0027Load Remote Images\u0027 setting being off has been resolved in watchOS 26.1 and iOS 26.1 through the implementation of additional logic.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43496 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43496.json"
}
],
"title": "CVE-2025-43496"
},
{
"cve": "CVE-2025-43497",
"notes": [
{
"category": "description",
"text": "An access issue was resolved by implementing additional restrictions in the sandbox environment to enhance security measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43497 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43497.json"
}
],
"title": "CVE-2025-43497"
},
{
"cve": "CVE-2025-43498",
"notes": [
{
"category": "description",
"text": "An authorization issue concerning sensitive user data access has been resolved through enhanced state management in iOS 26.1 and macOS Sequoia 15.7.2.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43498 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43498.json"
}
],
"title": "CVE-2025-43498"
},
{
"cve": "CVE-2025-43499",
"notes": [
{
"category": "description",
"text": "macOS Sonoma 14.8.2 and macOS Sequoia 15.7.2 have resolved the issue of potential sensitive user data access through the implementation of additional entitlement checks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43499 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43499.json"
}
],
"title": "CVE-2025-43499"
},
{
"cve": "CVE-2025-43500",
"notes": [
{
"category": "description",
"text": "Recent updates in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 have resolved a privacy issue regarding user preferences, enhancing the protection of sensitive user data from app access.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43500 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43500.json"
}
],
"title": "CVE-2025-43500"
},
{
"cve": "CVE-2025-43502",
"notes": [
{
"category": "description",
"text": "Recent updates in iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1 addressed a privacy issue by removing sensitive data to prevent the bypassing of privacy preferences.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43502 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43502.json"
}
],
"title": "CVE-2025-43502"
},
{
"cve": "CVE-2025-43503",
"notes": [
{
"category": "description",
"text": "An inconsistent user interface issue related to state management has been resolved across multiple operating systems, including watchOS, iOS, iPadOS, Safari, and visionOS, addressing potential spoofing risks from malicious websites.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43503 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43503.json"
}
],
"title": "CVE-2025-43503"
},
{
"cve": "CVE-2025-43506",
"notes": [
{
"category": "description",
"text": "A logic error was addressed by improving the error handling process, enhancing overall system reliability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43506 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43506.json"
}
],
"title": "CVE-2025-43506"
},
{
"cve": "CVE-2025-43507",
"notes": [
{
"category": "description",
"text": "A privacy issue related to user fingerprinting was resolved in watchOS 26.1, iOS 26.1, iPadOS 26.1, and visionOS 26.1 by relocating sensitive data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-43507 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-43507.json"
}
],
"title": "CVE-2025-43507"
},
{
"cve": "CVE-2025-53906",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "Vim version 9.1.1629 addresses multiple vulnerabilities, including path traversal issues in the tar.vim and zip.vim plugins, as well as memory management errors.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-53906 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-53906.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4"
]
}
],
"title": "CVE-2025-53906"
}
]
}
RHSA-2025:23583
Vulnerability from csaf_redhat - Published: 2025-12-18 09:30 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkitgtk4 security update
Notes
Topic
An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23583",
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23583.json"
}
],
"title": "Red Hat Security Advisory: webkitgtk4 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:06+00:00",
"generator": {
"date": "2025-12-22T20:50:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23583",
"initial_release_date": "2025-12-18T09:30:34+00:00",
"revision_history": [
{
"date": "2025-12-18T09:30:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-18T09:30:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_els:7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.3-2.el7_9.src",
"product": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.src",
"product_id": "webkitgtk4-0:2.50.3-2.el7_9.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.3-2.el7_9?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"product": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"product_id": "webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.3-2.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"product": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"product_id": "webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-devel@2.50.3-2.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"product": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"product_id": "webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc@2.50.3-2.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"product": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"product_id": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc-devel@2.50.3-2.el7_9?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"product": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"product_id": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-debuginfo@2.50.3-2.el7_9?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.3-2.el7_9.s390x",
"product": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.s390x",
"product_id": "webkitgtk4-0:2.50.3-2.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.3-2.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"product": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"product_id": "webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc@2.50.3-2.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"product": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"product_id": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-debuginfo@2.50.3-2.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"product": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"product_id": "webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-devel@2.50.3-2.el7_9?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"product": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"product_id": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc-devel@2.50.3-2.el7_9?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"product_id": "webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4@2.50.3-2.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"product_id": "webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-devel@2.50.3-2.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"product_id": "webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc@2.50.3-2.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"product_id": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-jsc-devel@2.50.3-2.el7_9?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"product": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"product_id": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-debuginfo@2.50.3-2.el7_9?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"product": {
"name": "webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"product_id": "webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkitgtk4-doc@2.50.3-2.el7_9?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.src",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-doc-0:2.50.3-2.el7_9.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch"
},
"product_reference": "webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)",
"product_id": "7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.src",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-doc-0:2.50.3-2.el7_9.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch"
},
"product_reference": "webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"relates_to_product_reference": "7Server-optional-ELS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)",
"product_id": "7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
},
"product_reference": "webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"relates_to_product_reference": "7Server-optional-ELS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.src",
"7Server-optional-ELS:webkitgtk4-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-debuginfo-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-devel-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-doc-0:2.50.3-2.el7_9.noarch",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-0:2.50.3-2.el7_9.x86_64",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.ppc64le",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.s390x",
"7Server-optional-ELS:webkitgtk4-jsc-devel-0:2.50.3-2.el7_9.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23433
Vulnerability from csaf_redhat - Published: 2025-12-17 04:58 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23433",
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23433.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:01+00:00",
"generator": {
"date": "2025-12-22T20:50:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23433",
"initial_release_date": "2025-12-17T04:58:31+00:00",
"revision_history": [
{
"date": "2025-12-17T04:58:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-17T04:58:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_2.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_2.src",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_2.src as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_2.src",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v. 8.2)",
"product_id": "AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"relates_to_product_reference": "AppStream-8.2.0.Z.AUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T04:58:31+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.src",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_2.x86_64",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.i686",
"AppStream-8.2.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23451
Vulnerability from csaf_redhat - Published: 2025-12-17 12:19 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23451",
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23451.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:04+00:00",
"generator": {
"date": "2025-12-22T20:50:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23451",
"initial_release_date": "2025-12-17T12:19:18+00:00",
"revision_history": [
{
"date": "2025-12-17T12:19:18+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-17T12:19:18+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_2.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.src",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_2?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_2.src",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T12:19:18+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.src",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_2.x86_64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.aarch64",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.i686",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.ppc64le",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.s390x",
"AppStream-9.2.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23743
Vulnerability from csaf_redhat - Published: 2025-12-22 01:45 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23743",
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23743.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:07+00:00",
"generator": {
"date": "2025-12-22T20:50:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23743",
"initial_release_date": "2025-12-22T01:45:22+00:00",
"revision_history": [
{
"date": "2025-12-22T01:45:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-22T01:45:22+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_tus:8.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_6.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.src",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.6)",
"product_id": "AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:45:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.aarch64",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.ppc64le",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.s390x",
"AppStream-8.6.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.src",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_6.x86_64",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.i686",
"AppStream-8.6.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23591
Vulnerability from csaf_redhat - Published: 2025-12-18 09:21 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23591",
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23591.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:06+00:00",
"generator": {
"date": "2025-12-22T20:50:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23591",
"initial_release_date": "2025-12-18T09:21:56+00:00",
"revision_history": [
{
"date": "2025-12-18T09:21:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-18T09:21:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_4.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.src",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_4?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_4?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_4?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_4?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_4?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_4?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_4?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_4.src",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)",
"product_id": "AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"relates_to_product_reference": "AppStream-9.4.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-18T09:21:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.src",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_4.x86_64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.aarch64",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.i686",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.ppc64le",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.s390x",
"AppStream-9.4.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23742
Vulnerability from csaf_redhat - Published: 2025-12-22 01:58 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23742",
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23742.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:06+00:00",
"generator": {
"date": "2025-12-22T20:50:06+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23742",
"initial_release_date": "2025-12-22T01:58:29+00:00",
"revision_history": [
{
"date": "2025-12-22T01:58:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-22T01:58:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:06+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_8.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.src",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_8?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_8?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_8.src",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
"product_id": "AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_8.src",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-22T01:58:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.ppc64le",
"AppStream-8.8.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.src",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_8.x86_64",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.i686",
"AppStream-8.8.0.Z.TUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23452
Vulnerability from csaf_redhat - Published: 2025-12-17 14:04 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23452",
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23452.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:04+00:00",
"generator": {
"date": "2025-12-22T20:50:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23452",
"initial_release_date": "2025-12-17T14:04:17+00:00",
"revision_history": [
{
"date": "2025-12-17T14:04:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-17T14:04:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.0::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_0.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.src",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_0?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_0?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_0?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_0?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_0?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_0?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_0?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_0?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_0?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_0?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_0?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_0.src",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0)",
"product_id": "AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"relates_to_product_reference": "AppStream-9.0.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T14:04:17+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.src",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-debugsource-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_0.x86_64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.aarch64",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.i686",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.ppc64le",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.s390x",
"AppStream-9.0.0.Z.E4S:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_0.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:22789
Vulnerability from csaf_redhat - Published: 2025-12-08 01:55 - Updated: 2025-12-22 20:49Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:22789",
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22789.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:49:58+00:00",
"generator": {
"date": "2025-12-22T20:49:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:22789",
"initial_release_date": "2025-12-08T01:55:51+00:00",
"revision_history": [
{
"date": "2025-12-08T01:55:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-11T13:16:30+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:49:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el8_10?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el8_10.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.src",
"product_id": "webkit2gtk3-0:2.50.3-1.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:55:51+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.i686",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23110
Vulnerability from csaf_redhat - Published: 2025-12-11 11:41 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23110",
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23110.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:01+00:00",
"generator": {
"date": "2025-12-22T20:50:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23110",
"initial_release_date": "2025-12-11T11:41:11+00:00",
"revision_history": [
{
"date": "2025-12-11T11:41:11+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-11T11:41:11+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_6.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.src",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_6?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_6?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_6?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_6?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_6?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_6?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_6.src",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-11T11:41:11+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23110"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.src",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-debugsource-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_6.x86_64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.aarch64",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.i686",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.ppc64le",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.s390x",
"AppStream-9.6.0.Z.EUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:23434
Vulnerability from csaf_redhat - Published: 2025-12-17 06:13 - Updated: 2025-12-22 20:50Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:23434",
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23434.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:50:01+00:00",
"generator": {
"date": "2025-12-22T20:50:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:23434",
"initial_release_date": "2025-12-17T06:13:37+00:00",
"revision_history": [
{
"date": "2025-12-17T06:13:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-17T06:13:37+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:50:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.4::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_4.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.src",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_4?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_4?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-2.el8_4?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-2.el8_4?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_4.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)",
"product_id": "AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_4.src",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)",
"product_id": "AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"relates_to_product_reference": "AppStream-8.4.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-17T06:13:37+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.src",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.50.3-2.el8_4.x86_64",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.i686",
"AppStream-8.4.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-2.el8_4.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
RHSA-2025:22790
Vulnerability from csaf_redhat - Published: 2025-12-08 01:59 - Updated: 2025-12-22 20:49Summary
Red Hat Security Advisory: webkit2gtk3 security update
Notes
Topic
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n\n* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n\n* webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:22790",
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22790.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security update",
"tracking": {
"current_release_date": "2025-12-22T20:49:59+00:00",
"generator": {
"date": "2025-12-22T20:49:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.14"
}
},
"id": "RHSA-2025:22790",
"initial_release_date": "2025-12-08T01:59:46+00:00",
"revision_history": [
{
"date": "2025-12-08T01:59:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-12-11T14:32:30+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-12-22T20:49:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_7.src",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.src",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_7?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_7?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_7?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.50.3-1.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.50.3-1.el9_7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_7.src",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Stanislav Fort",
"Aisle Research"
]
}
],
"cve": "CVE-2025-13502",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2025-11-21T07:47:33.751000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416300"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"
},
{
"category": "external",
"summary": "RHBZ#2416300",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416300"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13502"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13502"
}
],
"release_date": "2025-11-25T07:59:40.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS"
},
{
"acknowledgments": [
{
"names": [
"Janet Black"
]
}
],
"cve": "CVE-2025-13947",
"discovery_date": "2025-12-03T08:57:27.767000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has assessed the severity of this vulnerability as High, as it enables remote websites to extract arbitrary files from a user\u2019s system with minimal interaction. Although some user action is required, the action can be trivial and easily induced by a malicious page. The issue arises from missing validation that a dragged file originated from an external application, enabling unintended file system access. Successful exploitation can compromise confidentiality of local user data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"
},
{
"category": "external",
"summary": "RHBZ#2418576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13947"
}
],
"release_date": "2025-12-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop"
},
{
"cve": "CVE-2025-43392",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-11-21T12:39:51.810000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: A website may exfiltrate image data cross-origin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43392"
},
{
"category": "external",
"summary": "RHBZ#2416325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webkitgtk: A website may exfiltrate image data cross-origin"
},
{
"cve": "CVE-2025-43421",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T15:57:10.661000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause multiple issues in the JIT compiler and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43421"
},
{
"category": "external",
"summary": "RHBZ#2416355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43421"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43425",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:42:33.890000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416327"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43425"
},
{
"category": "external",
"summary": "RHBZ#2416327",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416327"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43425"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43427",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:43:48.629000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416329"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43427"
},
{
"category": "external",
"summary": "RHBZ#2416329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416329"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43427"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43429",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:44:50.827000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper bounds checking and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43429"
},
{
"category": "external",
"summary": "RHBZ#2416330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43429"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43430",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-11-21T12:45:54.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416331"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43430"
},
{
"category": "external",
"summary": "RHBZ#2416331",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416331"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43430"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43431",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-11-21T12:47:02.159000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416332"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43431"
},
{
"category": "external",
"summary": "RHBZ#2416332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43431"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption"
},
{
"cve": "CVE-2025-43432",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:47:57.077000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416334"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43432"
},
{
"category": "external",
"summary": "RHBZ#2416334",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416334"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43432"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43434",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-11-21T12:49:09.733000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43434"
},
{
"category": "external",
"summary": "RHBZ#2416335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43434"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash"
},
{
"cve": "CVE-2025-43440",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:50:27.289000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43440"
},
{
"category": "external",
"summary": "RHBZ#2416336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43440"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43443",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-11-21T12:51:26.005000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2416337"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43443"
},
{
"category": "external",
"summary": "RHBZ#2416337",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416337"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43443"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0008.html",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
}
],
"release_date": "2025-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Do not process or load untrusted web content with WebKitGTK.\n\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\n\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\n\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\n\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-43458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2025-12-04T16:02:08.461000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418855"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-43458"
},
{
"category": "external",
"summary": "RHBZ#2418855",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418855"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43458"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
},
{
"cve": "CVE-2025-66287",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-12-04T16:04:58.978000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.\nAdditionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"
},
{
"category": "external",
"summary": "RHBZ#2418857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66287",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66287"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66287"
},
{
"category": "external",
"summary": "https://webkitgtk.org/security/WSA-2025-0009.html",
"url": "https://webkitgtk.org/security/WSA-2025-0009.html"
}
],
"release_date": "2025-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-12-08T01:59:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.src",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-debugsource-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-devel-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-debuginfo-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-0:2.50.3-1.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.i686",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:webkit2gtk3-jsc-devel-debuginfo-0:2.50.3-1.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash"
}
]
}
CERTFR-2025-AVI-0961
Vulnerability from certfr_avis - Published: 2025-11-04 - Updated: 2025-11-04
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | macOS | macOS Tahoe versions antérieures à 26.1 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26.1 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.7.2 | ||
| Apple | Safari | Safari versions antérieures à 26.1 | ||
| Apple | Xcode | Xcode versions antérieures à 26.1 | ||
| Apple | watchOS | watchOS versions antérieures à 26.1 | ||
| Apple | iOS | iOS versions antérieures à 26.1 | ||
| Apple | tvOS | tvOS versions antérieures à 26.1 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.8.2 | ||
| Apple | visionOS | visionOS versions antérieures à 26.1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43292",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43292"
},
{
"name": "CVE-2025-43505",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43505"
},
{
"name": "CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"name": "CVE-2025-43372",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43372"
},
{
"name": "CVE-2025-43426",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43426"
},
{
"name": "CVE-2025-43480",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43480"
},
{
"name": "CVE-2025-43449",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43449"
},
{
"name": "CVE-2025-43348",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43348"
},
{
"name": "CVE-2025-43351",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43351"
},
{
"name": "CVE-2025-43373",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43373"
},
{
"name": "CVE-2025-43441",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43441"
},
{
"name": "CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"name": "CVE-2025-43476",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43476"
},
{
"name": "CVE-2025-30465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30465"
},
{
"name": "CVE-2025-43448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43448"
},
{
"name": "CVE-2025-43497",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43497"
},
{
"name": "CVE-2025-43446",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43446"
},
{
"name": "CVE-2025-43500",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43500"
},
{
"name": "CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"name": "CVE-2025-43452",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43452"
},
{
"name": "CVE-2025-43504",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43504"
},
{
"name": "CVE-2025-43467",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43467"
},
{
"name": "CVE-2025-43496",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43496"
},
{
"name": "CVE-2025-43420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43420"
},
{
"name": "CVE-2025-43450",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43450"
},
{
"name": "CVE-2025-43406",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43406"
},
{
"name": "CVE-2025-43402",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43402"
},
{
"name": "CVE-2025-43384",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43384"
},
{
"name": "CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"name": "CVE-2025-43422",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43422"
},
{
"name": "CVE-2025-43503",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43503"
},
{
"name": "CVE-2025-43502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43502"
},
{
"name": "CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"name": "CVE-2024-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43398"
},
{
"name": "CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"name": "CVE-2025-43394",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43394"
},
{
"name": "CVE-2025-43335",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43335"
},
{
"name": "CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"name": "CVE-2025-43411",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43411"
},
{
"name": "CVE-2025-43469",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43469"
},
{
"name": "CVE-2025-43498",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43498"
},
{
"name": "CVE-2025-43424",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43424"
},
{
"name": "CVE-2025-43423",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43423"
},
{
"name": "CVE-2025-43472",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43472"
},
{
"name": "CVE-2025-43459",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43459"
},
{
"name": "CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"name": "CVE-2025-43462",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43462"
},
{
"name": "CVE-2025-43401",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43401"
},
{
"name": "CVE-2025-43386",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43386"
},
{
"name": "CVE-2025-43493",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43493"
},
{
"name": "CVE-2025-43481",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43481"
},
{
"name": "CVE-2025-43405",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43405"
},
{
"name": "CVE-2025-43506",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43506"
},
{
"name": "CVE-2025-43322",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43322"
},
{
"name": "CVE-2025-32462",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32462"
},
{
"name": "CVE-2025-43400",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43400"
},
{
"name": "CVE-2025-43468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43468"
},
{
"name": "CVE-2025-43395",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43395"
},
{
"name": "CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"name": "CVE-2025-43435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43435"
},
{
"name": "CVE-2025-43464",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43464"
},
{
"name": "CVE-2025-43442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43442"
},
{
"name": "CVE-2025-43377",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43377"
},
{
"name": "CVE-2025-43438",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43438"
},
{
"name": "CVE-2025-43460",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43460"
},
{
"name": "CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"name": "CVE-2025-43407",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43407"
},
{
"name": "CVE-2025-43334",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43334"
},
{
"name": "CVE-2025-43414",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43414"
},
{
"name": "CVE-2025-43385",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43385"
},
{
"name": "CVE-2025-43444",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43444"
},
{
"name": "CVE-2025-43404",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43404"
},
{
"name": "CVE-2025-43495",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43495"
},
{
"name": "CVE-2025-43465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43465"
},
{
"name": "CVE-2025-43461",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43461"
},
{
"name": "CVE-2025-43294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43294"
},
{
"name": "CVE-2025-43390",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43390"
},
{
"name": "CVE-2025-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43499"
},
{
"name": "CVE-2025-43350",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43350"
},
{
"name": "CVE-2025-43391",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43391"
},
{
"name": "CVE-2025-43378",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43378"
},
{
"name": "CVE-2025-43473",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43473"
},
{
"name": "CVE-2025-43445",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43445"
},
{
"name": "CVE-2025-43338",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43338"
},
{
"name": "CVE-2025-43409",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43409"
},
{
"name": "CVE-2025-43399",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43399"
},
{
"name": "CVE-2025-43383",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43383"
},
{
"name": "CVE-2025-43474",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43474"
},
{
"name": "CVE-2025-43471",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43471"
},
{
"name": "CVE-2025-43387",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43387"
},
{
"name": "CVE-2025-43479",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43479"
},
{
"name": "CVE-2025-43447",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43447"
},
{
"name": "CVE-2025-43477",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43477"
},
{
"name": "CVE-2025-43413",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43413"
},
{
"name": "CVE-2025-43507",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43507"
},
{
"name": "CVE-2025-43336",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43336"
},
{
"name": "CVE-2025-43433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43433"
},
{
"name": "CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"name": "CVE-2025-43337",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43337"
},
{
"name": "CVE-2025-43380",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43380"
},
{
"name": "CVE-2025-43397",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43397"
},
{
"name": "CVE-2025-43455",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43455"
},
{
"name": "CVE-2025-53906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53906"
},
{
"name": "CVE-2025-43412",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43412"
},
{
"name": "CVE-2025-43388",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43388"
},
{
"name": "CVE-2025-43396",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43396"
},
{
"name": "CVE-2025-43454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43454"
},
{
"name": "CVE-2025-43439",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43439"
},
{
"name": "CVE-2025-43381",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43381"
},
{
"name": "CVE-2025-43382",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43382"
},
{
"name": "CVE-2025-43466",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43466"
},
{
"name": "CVE-2025-43364",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43364"
},
{
"name": "CVE-2025-43393",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43393"
},
{
"name": "CVE-2025-43389",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43389"
},
{
"name": "CVE-2025-43457",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43457"
},
{
"name": "CVE-2025-43361",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43361"
},
{
"name": "CVE-2025-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43398"
},
{
"name": "CVE-2025-31199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31199"
},
{
"name": "CVE-2025-43408",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43408"
},
{
"name": "CVE-2025-43379",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43379"
},
{
"name": "CVE-2025-6442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6442"
},
{
"name": "CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"name": "CVE-2025-43478",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43478"
},
{
"name": "CVE-2025-43436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43436"
},
{
"name": "CVE-2024-49761",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49761"
},
{
"name": "CVE-2025-43463",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43463"
}
],
"initial_release_date": "2025-11-04T00:00:00",
"last_revision_date": "2025-11-04T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0961",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-11-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125639",
"url": "https://support.apple.com/en-us/125639"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125640",
"url": "https://support.apple.com/en-us/125640"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125634",
"url": "https://support.apple.com/en-us/125634"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125632",
"url": "https://support.apple.com/en-us/125632"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125638",
"url": "https://support.apple.com/en-us/125638"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125635",
"url": "https://support.apple.com/en-us/125635"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125641",
"url": "https://support.apple.com/en-us/125641"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125636",
"url": "https://support.apple.com/en-us/125636"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125637",
"url": "https://support.apple.com/en-us/125637"
}
]
}
CERTFR-2025-AVI-0961
Vulnerability from certfr_avis - Published: 2025-11-04 - Updated: 2025-11-04
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | macOS | macOS Tahoe versions antérieures à 26.1 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26.1 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.7.2 | ||
| Apple | Safari | Safari versions antérieures à 26.1 | ||
| Apple | Xcode | Xcode versions antérieures à 26.1 | ||
| Apple | watchOS | watchOS versions antérieures à 26.1 | ||
| Apple | iOS | iOS versions antérieures à 26.1 | ||
| Apple | tvOS | tvOS versions antérieures à 26.1 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.8.2 | ||
| Apple | visionOS | visionOS versions antérieures à 26.1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.1",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43292",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43292"
},
{
"name": "CVE-2025-43505",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43505"
},
{
"name": "CVE-2025-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
},
{
"name": "CVE-2025-43372",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43372"
},
{
"name": "CVE-2025-43426",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43426"
},
{
"name": "CVE-2025-43480",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43480"
},
{
"name": "CVE-2025-43449",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43449"
},
{
"name": "CVE-2025-43348",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43348"
},
{
"name": "CVE-2025-43351",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43351"
},
{
"name": "CVE-2025-43373",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43373"
},
{
"name": "CVE-2025-43441",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43441"
},
{
"name": "CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"name": "CVE-2025-43476",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43476"
},
{
"name": "CVE-2025-30465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30465"
},
{
"name": "CVE-2025-43448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43448"
},
{
"name": "CVE-2025-43497",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43497"
},
{
"name": "CVE-2025-43446",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43446"
},
{
"name": "CVE-2025-43500",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43500"
},
{
"name": "CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"name": "CVE-2025-43452",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43452"
},
{
"name": "CVE-2025-43504",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43504"
},
{
"name": "CVE-2025-43467",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43467"
},
{
"name": "CVE-2025-43496",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43496"
},
{
"name": "CVE-2025-43420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43420"
},
{
"name": "CVE-2025-43450",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43450"
},
{
"name": "CVE-2025-43406",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43406"
},
{
"name": "CVE-2025-43402",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43402"
},
{
"name": "CVE-2025-43384",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43384"
},
{
"name": "CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"name": "CVE-2025-43422",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43422"
},
{
"name": "CVE-2025-43503",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43503"
},
{
"name": "CVE-2025-43502",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43502"
},
{
"name": "CVE-2025-43440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
},
{
"name": "CVE-2024-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43398"
},
{
"name": "CVE-2025-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
},
{
"name": "CVE-2025-43394",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43394"
},
{
"name": "CVE-2025-43335",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43335"
},
{
"name": "CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"name": "CVE-2025-43411",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43411"
},
{
"name": "CVE-2025-43469",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43469"
},
{
"name": "CVE-2025-43498",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43498"
},
{
"name": "CVE-2025-43424",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43424"
},
{
"name": "CVE-2025-43423",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43423"
},
{
"name": "CVE-2025-43472",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43472"
},
{
"name": "CVE-2025-43459",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43459"
},
{
"name": "CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"name": "CVE-2025-43462",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43462"
},
{
"name": "CVE-2025-43401",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43401"
},
{
"name": "CVE-2025-43386",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43386"
},
{
"name": "CVE-2025-43493",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43493"
},
{
"name": "CVE-2025-43481",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43481"
},
{
"name": "CVE-2025-43405",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43405"
},
{
"name": "CVE-2025-43506",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43506"
},
{
"name": "CVE-2025-43322",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43322"
},
{
"name": "CVE-2025-32462",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32462"
},
{
"name": "CVE-2025-43400",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43400"
},
{
"name": "CVE-2025-43468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43468"
},
{
"name": "CVE-2025-43395",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43395"
},
{
"name": "CVE-2025-43421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
},
{
"name": "CVE-2025-43435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43435"
},
{
"name": "CVE-2025-43464",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43464"
},
{
"name": "CVE-2025-43442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43442"
},
{
"name": "CVE-2025-43377",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43377"
},
{
"name": "CVE-2025-43438",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43438"
},
{
"name": "CVE-2025-43460",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43460"
},
{
"name": "CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"name": "CVE-2025-43407",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43407"
},
{
"name": "CVE-2025-43334",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43334"
},
{
"name": "CVE-2025-43414",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43414"
},
{
"name": "CVE-2025-43385",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43385"
},
{
"name": "CVE-2025-43444",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43444"
},
{
"name": "CVE-2025-43404",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43404"
},
{
"name": "CVE-2025-43495",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43495"
},
{
"name": "CVE-2025-43465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43465"
},
{
"name": "CVE-2025-43461",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43461"
},
{
"name": "CVE-2025-43294",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43294"
},
{
"name": "CVE-2025-43390",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43390"
},
{
"name": "CVE-2025-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43499"
},
{
"name": "CVE-2025-43350",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43350"
},
{
"name": "CVE-2025-43391",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43391"
},
{
"name": "CVE-2025-43378",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43378"
},
{
"name": "CVE-2025-43473",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43473"
},
{
"name": "CVE-2025-43445",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43445"
},
{
"name": "CVE-2025-43338",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43338"
},
{
"name": "CVE-2025-43409",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43409"
},
{
"name": "CVE-2025-43399",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43399"
},
{
"name": "CVE-2025-43383",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43383"
},
{
"name": "CVE-2025-43474",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43474"
},
{
"name": "CVE-2025-43471",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43471"
},
{
"name": "CVE-2025-43387",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43387"
},
{
"name": "CVE-2025-43479",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43479"
},
{
"name": "CVE-2025-43447",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43447"
},
{
"name": "CVE-2025-43477",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43477"
},
{
"name": "CVE-2025-43413",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43413"
},
{
"name": "CVE-2025-43507",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43507"
},
{
"name": "CVE-2025-43336",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43336"
},
{
"name": "CVE-2025-43433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43433"
},
{
"name": "CVE-2025-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
},
{
"name": "CVE-2025-43337",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43337"
},
{
"name": "CVE-2025-43380",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43380"
},
{
"name": "CVE-2025-43397",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43397"
},
{
"name": "CVE-2025-43455",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43455"
},
{
"name": "CVE-2025-53906",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-53906"
},
{
"name": "CVE-2025-43412",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43412"
},
{
"name": "CVE-2025-43388",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43388"
},
{
"name": "CVE-2025-43396",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43396"
},
{
"name": "CVE-2025-43454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43454"
},
{
"name": "CVE-2025-43439",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43439"
},
{
"name": "CVE-2025-43381",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43381"
},
{
"name": "CVE-2025-43382",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43382"
},
{
"name": "CVE-2025-43466",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43466"
},
{
"name": "CVE-2025-43364",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43364"
},
{
"name": "CVE-2025-43393",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43393"
},
{
"name": "CVE-2025-43389",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43389"
},
{
"name": "CVE-2025-43457",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43457"
},
{
"name": "CVE-2025-43361",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43361"
},
{
"name": "CVE-2025-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43398"
},
{
"name": "CVE-2025-31199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31199"
},
{
"name": "CVE-2025-43408",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43408"
},
{
"name": "CVE-2025-43379",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43379"
},
{
"name": "CVE-2025-6442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6442"
},
{
"name": "CVE-2025-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
},
{
"name": "CVE-2025-43478",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43478"
},
{
"name": "CVE-2025-43436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43436"
},
{
"name": "CVE-2024-49761",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49761"
},
{
"name": "CVE-2025-43463",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43463"
}
],
"initial_release_date": "2025-11-04T00:00:00",
"last_revision_date": "2025-11-04T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0961",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-11-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125639",
"url": "https://support.apple.com/en-us/125639"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125640",
"url": "https://support.apple.com/en-us/125640"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125634",
"url": "https://support.apple.com/en-us/125634"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125632",
"url": "https://support.apple.com/en-us/125632"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125638",
"url": "https://support.apple.com/en-us/125638"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125635",
"url": "https://support.apple.com/en-us/125635"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125641",
"url": "https://support.apple.com/en-us/125641"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125636",
"url": "https://support.apple.com/en-us/125636"
},
{
"published_at": "2025-11-03",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125637",
"url": "https://support.apple.com/en-us/125637"
}
]
}
CERTFR-2025-AVI-0974
Vulnerability from certfr_avis - Published: 2025-11-06 - Updated: 2025-11-06
De multiples vulnérabilités ont été découvertes dans Apple iOS et iPadOS. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 18.7.2",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 18.7.2",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43441",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43441"
},
{
"name": "CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"name": "CVE-2025-43448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43448"
},
{
"name": "CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"name": "CVE-2025-43496",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43496"
},
{
"name": "CVE-2025-43450",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43450"
},
{
"name": "CVE-2025-43384",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43384"
},
{
"name": "CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"name": "CVE-2025-43503",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43503"
},
{
"name": "CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"name": "CVE-2025-43423",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43423"
},
{
"name": "CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"name": "CVE-2025-43386",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43386"
},
{
"name": "CVE-2025-43493",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43493"
},
{
"name": "CVE-2025-43418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43418"
},
{
"name": "CVE-2025-43435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43435"
},
{
"name": "CVE-2025-43442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43442"
},
{
"name": "CVE-2025-43377",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43377"
},
{
"name": "CVE-2025-43438",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43438"
},
{
"name": "CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"name": "CVE-2025-43385",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43385"
},
{
"name": "CVE-2025-43444",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43444"
},
{
"name": "CVE-2025-43365",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43365"
},
{
"name": "CVE-2025-43495",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43495"
},
{
"name": "CVE-2025-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43499"
},
{
"name": "CVE-2025-43445",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43445"
},
{
"name": "CVE-2025-43399",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43399"
},
{
"name": "CVE-2025-43383",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43383"
},
{
"name": "CVE-2025-43507",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43507"
},
{
"name": "CVE-2025-43433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43433"
},
{
"name": "CVE-2025-43454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43454"
},
{
"name": "CVE-2025-43439",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43439"
},
{
"name": "CVE-2025-43389",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43389"
},
{
"name": "CVE-2025-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43398"
}
],
"initial_release_date": "2025-11-06T00:00:00",
"last_revision_date": "2025-11-06T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0974",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-11-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apple iOS et iPadOS. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple iOS et iPadOS",
"vendor_advisories": [
{
"published_at": "2025-11-05",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125633",
"url": "https://support.apple.com/en-us/125633"
}
]
}
CERTFR-2025-AVI-0974
Vulnerability from certfr_avis - Published: 2025-11-06 - Updated: 2025-11-06
De multiples vulnérabilités ont été découvertes dans Apple iOS et iPadOS. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 18.7.2",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 18.7.2",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-43441",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43441"
},
{
"name": "CVE-2025-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
},
{
"name": "CVE-2025-43448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43448"
},
{
"name": "CVE-2025-43431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
},
{
"name": "CVE-2025-43496",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43496"
},
{
"name": "CVE-2025-43450",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43450"
},
{
"name": "CVE-2025-43384",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43384"
},
{
"name": "CVE-2025-43434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
},
{
"name": "CVE-2025-43503",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43503"
},
{
"name": "CVE-2025-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
},
{
"name": "CVE-2025-43423",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43423"
},
{
"name": "CVE-2025-43392",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
},
{
"name": "CVE-2025-43386",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43386"
},
{
"name": "CVE-2025-43493",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43493"
},
{
"name": "CVE-2025-43418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43418"
},
{
"name": "CVE-2025-43435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43435"
},
{
"name": "CVE-2025-43442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43442"
},
{
"name": "CVE-2025-43377",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43377"
},
{
"name": "CVE-2025-43438",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43438"
},
{
"name": "CVE-2025-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
},
{
"name": "CVE-2025-43385",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43385"
},
{
"name": "CVE-2025-43444",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43444"
},
{
"name": "CVE-2025-43365",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43365"
},
{
"name": "CVE-2025-43495",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43495"
},
{
"name": "CVE-2025-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43499"
},
{
"name": "CVE-2025-43445",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43445"
},
{
"name": "CVE-2025-43399",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43399"
},
{
"name": "CVE-2025-43383",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43383"
},
{
"name": "CVE-2025-43507",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43507"
},
{
"name": "CVE-2025-43433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43433"
},
{
"name": "CVE-2025-43454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43454"
},
{
"name": "CVE-2025-43439",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43439"
},
{
"name": "CVE-2025-43389",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43389"
},
{
"name": "CVE-2025-43398",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43398"
}
],
"initial_release_date": "2025-11-06T00:00:00",
"last_revision_date": "2025-11-06T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0974",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-11-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apple iOS et iPadOS. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple iOS et iPadOS",
"vendor_advisories": [
{
"published_at": "2025-11-05",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 125633",
"url": "https://support.apple.com/en-us/125633"
}
]
}
WID-SEC-W-2025-2657
Vulnerability from csaf_certbund - Published: 2025-11-20 23:00 - Updated: 2025-12-21 23:00Summary
WebKitGTK: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
WebKitGTK ist ein Webbrowser. Dieser nutzt die WebKit-Engine, die auch von Safari und vielen anderen Apps auf macOS, iOS und Linux verwendet wird.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in WebKitGTK ausnutzen, um Memory Corruption, Prozessabstürze (DoS) oder Cross-Origin-Datenexfiltration zu verursachen oder potentiell Code auszuführen.
Betroffene Betriebssysteme
- iPhoneOS
- MacOS X
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "WebKitGTK ist ein Webbrowser. Dieser nutzt die WebKit-Engine, die auch von Safari und vielen anderen Apps auf macOS, iOS und Linux verwendet wird.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in WebKitGTK ausnutzen, um Memory Corruption, Prozessabst\u00fcrze (DoS) oder Cross-Origin-Datenexfiltration zu verursachen oder potentiell Code auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- iPhoneOS\n- MacOS X",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-2657 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2657.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-2657 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2657"
},
{
"category": "external",
"summary": "WebKitGTK and WPE WebKit Security Advisory vom 2025-11-20",
"url": "https://webkitgtk.org/security/WSA-2025-0008.html"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2025-6F3E9E3AF6 vom 2025-11-23",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-6f3e9e3af6"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-4394 vom 2025-12-04",
"url": "https://lists.debian.org/debian-lts-announce/2025/12/msg00005.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-6070 vom 2025-12-04",
"url": "https://lists.debian.org/debian-security-announce/2025/msg00236.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22790 vom 2025-12-08",
"url": "https://access.redhat.com/errata/RHSA-2025:22790"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22789 vom 2025-12-08",
"url": "https://access.redhat.com/errata/RHSA-2025:22789"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-22790 vom 2025-12-09",
"url": "http://linux.oracle.com/errata/ELSA-2025-22790.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7914-1 vom 2025-12-08",
"url": "https://ubuntu.com/security/notices/USN-7914-1"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-22789 vom 2025-12-09",
"url": "http://linux.oracle.com/errata/ELSA-2025-22789.html"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:22790 vom 2025-12-09",
"url": "https://errata.build.resf.org/RLSA-2025:22790"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:22789 vom 2025-12-09",
"url": "https://errata.build.resf.org/RLSA-2025:22789"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4416-1 vom 2025-12-16",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023564.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23451 vom 2025-12-17",
"url": "https://access.redhat.com/errata/RHSA-2025:23451"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23434 vom 2025-12-17",
"url": "https://access.redhat.com/errata/RHSA-2025:23434"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23433 vom 2025-12-17",
"url": "https://access.redhat.com/errata/RHSA-2025:23433"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23452 vom 2025-12-17",
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4423-1 vom 2025-12-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023572.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23591 vom 2025-12-18",
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23583 vom 2025-12-18",
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23742 vom 2025-12-22",
"url": "https://access.redhat.com/errata/RHSA-2025:23742"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23743 vom 2025-12-22",
"url": "https://access.redhat.com/errata/RHSA-2025:23743"
}
],
"source_lang": "en-US",
"title": "WebKitGTK: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-12-21T23:00:00.000+00:00",
"generator": {
"date": "2025-12-22T08:55:00.422+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2025-2657",
"initial_release_date": "2025-11-20T23:00:00.000+00:00",
"revision_history": [
{
"date": "2025-11-20T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-11-23T23:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Fedora aufgenommen"
},
{
"date": "2025-12-03T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2025-12-07T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-12-08T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Oracle Linux und Ubuntu aufgenommen"
},
{
"date": "2025-12-16T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE und Red Hat aufgenommen"
},
{
"date": "2025-12-17T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Red Hat und SUSE aufgenommen"
},
{
"date": "2025-12-21T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "8"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Fedora Linux",
"product": {
"name": "Fedora Linux",
"product_id": "74185",
"product_identification_helper": {
"cpe": "cpe:/o:fedoraproject:fedora:-"
}
}
}
],
"category": "vendor",
"name": "Fedora"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c2.50.2",
"product": {
"name": "Open Source WebKitGTK \u003c2.50.2",
"product_id": "T048823"
}
},
{
"category": "product_version",
"name": "2.50.2",
"product": {
"name": "Open Source WebKitGTK 2.50.2",
"product_id": "T048823-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:webkitgtk:webkitgtk:2.50.2"
}
}
},
{
"category": "product_version_range",
"name": "\u003c2.51.2",
"product": {
"name": "Open Source WebKitGTK \u003c2.51.2",
"product_id": "T048825"
}
},
{
"category": "product_version",
"name": "2.51.2",
"product": {
"name": "Open Source WebKitGTK 2.51.2",
"product_id": "T048825-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:webkitgtk:webkitgtk:2.51.2"
}
}
}
],
"category": "product_name",
"name": "WebKitGTK"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T032255",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-43000",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2023-43000"
},
{
"cve": "CVE-2025-43392",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43392"
},
{
"cve": "CVE-2025-43419",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43419"
},
{
"cve": "CVE-2025-43425",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43425"
},
{
"cve": "CVE-2025-43427",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43427"
},
{
"cve": "CVE-2025-43429",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43429"
},
{
"cve": "CVE-2025-43430",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43430"
},
{
"cve": "CVE-2025-43431",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43431"
},
{
"cve": "CVE-2025-43432",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43432"
},
{
"cve": "CVE-2025-43434",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43434"
},
{
"cve": "CVE-2025-43440",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43440"
},
{
"cve": "CVE-2025-43443",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43443"
},
{
"cve": "CVE-2025-43480",
"product_status": {
"known_affected": [
"T048825",
"T048823",
"2951",
"T002207",
"67646",
"T000126",
"T004914",
"T032255",
"74185"
]
},
"release_date": "2025-11-20T23:00:00.000+00:00",
"title": "CVE-2025-43480"
}
]
}
GHSA-MCGQ-5C2Q-CHC3
Vulnerability from github – Published: 2025-11-04 03:30 – Updated: 2025-12-17 21:30
VLAI?
Details
The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A website may exfiltrate image data cross-origin.
Severity ?
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-43392"
],
"database_specific": {
"cwe_ids": [
"CWE-524",
"CWE-942"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-04T02:15:46Z",
"severity": "MODERATE"
},
"details": "The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A website may exfiltrate image data cross-origin.",
"id": "GHSA-mcgq-5c2q-chc3",
"modified": "2025-12-17T21:30:33Z",
"published": "2025-11-04T03:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43392"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125632"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125633"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125634"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125637"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125638"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125639"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/125640"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2025-43392
Vulnerability from fkie_nvd - Published: 2025-11-04 02:15 - Updated: 2025-12-17 21:15
Severity ?
Summary
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. A website may exfiltrate image data cross-origin.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CFF118CE-3F13-43BE-B250-5579E1C842EB",
"versionEndExcluding": "26.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6D51AEDC-9086-4010-B3BF-C652D65D09C8",
"versionEndExcluding": "26.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3981A7BE-BC98-4C6F-AE38-D68839368925",
"versionEndExcluding": "26.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "290E0D29-CB5B-45A7-9FE3-FD2030B1D1A4",
"versionEndExcluding": "26.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7DFD3616-65CA-4E5C-849C-3C20ACBCB610",
"versionEndExcluding": "26.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9F9D7F76-13FB-407C-94E5-221B93021568",
"versionEndExcluding": "26.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. A website may exfiltrate image data cross-origin."
}
],
"id": "CVE-2025-43392",
"lastModified": "2025-12-17T21:15:58.143",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-11-04T02:15:46.083",
"references": [
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/125632"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/125633"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/125634"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/125637"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/125638"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/125639"
},
{
"source": "product-security@apple.com",
"url": "https://support.apple.com/en-us/125640"
}
],
"sourceIdentifier": "product-security@apple.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-942"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…