Mageia alert MGASA-2026-0064 (webkit2)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2026-0064: Updated webkit2 packages fix security vulnerabilities
Date:
             
 
Tue, 24 Mar 2026 18:54:15 +0100
Message-ID:
             
 
<20260324175416.0C04BA0D27@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2026-0064 - Updated webkit2 packages fix security vulnerabilities

Publication date: 24 Mar 2026
URL: https://advisories.mageia.org/MGASA-2026-0064.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2025-43457,
     CVE-2026-20608,
     CVE-2026-20635,
     CVE-2026-20636,
     CVE-2026-20644,
     CVE-2026-20652,
     CVE-2026-20676

Description:
CVE-2025-43457 Processing maliciously crafted web content may lead to an
unexpected Safari crash. A use-after-free issue was addressed with improved
memory management.
CVE-2026-20608 Processing maliciously crafted web content may lead to an
unexpected process crash. This issue was addressed through improved state
management.
CVE-2026-20635 Processing maliciously crafted web content may lead to an
unexpected process crash. The issue was addressed with improved memory
handling.
CVE-2026-20636 Processing maliciously crafted web content may lead to an
unexpected process crash. The issue was addressed with improved memory
handling.
CVE-2026-20644 Processing maliciously crafted web content may lead to an
unexpected process crash. The issue was addressed with improved memory
handling.
CVE-2026-20652 A remote attacker may be able to cause a denial-of-service.
The issue was addressed with improved memory handling.
CVE-2026-20676 A website may be able to track users through Safari web
extensions. This issue was addressed through improved state management.

References:
- https://bugs.mageia.org/show_bug.cgi?id=35228
- https://webkitgtk.org/2026/03/12/webkitgtk2.50.6-released...
- https://webkitgtk.org/security/WSA-2026-0001.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2...

SRPMS:
- 9/core/webkit2-2.50.6-1.mga9