|
|
Log in / Subscribe / Register

SUSE alert openSUSE-SU-2026:21508-1 (webkit2gtk3)



From:
              null@suse.de


To:
              security-announce@lists.opensuse.org


Subject:
              openSUSE-SU-2026:21508-1: important: Security update for webkit2gtk3


Date:
              Sun, 02 Aug 2026 17:51:31 +0200


Message-ID:
              <20260802155131.C6294FDEC@maintenance.suse.de>


Archive-link:
              Article


openSUSE security update: security update for webkit2gtk3
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21508-1
Rating: important
References:

  * bsc#1271638



Cross-References:

  * CVE-2024-4367
  * CVE-2026-39872
  * CVE-2026-43663
  * CVE-2026-43676
  * CVE-2026-43699
  * CVE-2026-43701
  * CVE-2026-43705
  * CVE-2026-43707
  * CVE-2026-43712
  * CVE-2026-43713
  * CVE-2026-43715
  * CVE-2026-43716
  * CVE-2026-43720
  * CVE-2026-43721
  * CVE-2026-43725
  * CVE-2026-43726
  * CVE-2026-43727
  * CVE-2026-43731
  * CVE-2026-43732
  * CVE-2026-43734
  * CVE-2026-43740
  * CVE-2026-43742
  * CVE-2026-43745



CVSS scores:

  * CVE-2024-4367 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-39872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43663 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43676 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43699 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43701 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
  * CVE-2026-43705 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-43707 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43712 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43713 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  * CVE-2026-43715 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-43716 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43720 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43721 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  * CVE-2026-43725 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
  * CVE-2026-43726 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43727 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43731 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-43732 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  * CVE-2026-43734 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43740 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  * CVE-2026-43742 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-43745 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 23 vulnerabilities and has one bug fix can now be installed.

Description:

This update for webkit2gtk3 fixes the following issues:

- CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript
execution
  (bsc#1271638).
- CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43663: maliciously crafted web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43676: out-of-bounds access when processing web content can lead to an unexpected Safari
crash
  (bsc#1271638).
- CVE-2026-43699: use-after-free issue when processing web content can lead to an unexpected
process crash
  (bsc#1271638).
- CVE-2026-43701: malicious website can process restricted web content outside the sandbox
(bsc#1271638).
- CVE-2026-43705: type confusion issue when processing web content can lead to memory corruption
(bsc#1271638).
- CVE-2026-43707: memory corruption issue when processing web content can lead to an unexpected
process crash
  (bsc#1271638).
- CVE-2026-43712: maliciously crafted web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43713: visiting a website can leak sensitive data due to a permissions issue
(bsc#1271638).
- CVE-2026-43715: use-after-free issue when processing web content can lead to memory corruption
(bsc#1271638).
- CVE-2026-43716: maliciously crafted web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43720: use-after-free issue when processing web content can lead to an unexpected Safari
crash
  (bsc#1271638).
- CVE-2026-43721: malicious website can silently hijack clipboard data (bsc#1271638).
- CVE-2026-43725: unvalidated input can allow a malicious website to process restricted web content
outside the
  sandbox (bsc#1271638).
- CVE-2026-43726: use-after-free issue when processing web content can lead to an unexpected
process crash
  (bsc#1271638).
- CVE-2026-43727: use-after-free issue when processing web content can lead to an unexpected Safari
crash
  (bsc#1271638).
- CVE-2026-43731: use-after-free issue when processing web content can lead to memory corruption
(bsc#1271638).
- CVE-2026-43732: path handling issue when processing web content can disclose sensitive user
information
  (bsc#1271638).
- CVE-2026-43734: use-after-free issue when processing web content can lead to an unexpected
process crash
  (bsc#1271638).
- CVE-2026-43740: maliciously crafted web content can result in the disclosure of process memory
(bsc#1271638).
- CVE-2026-43742: use-after-free issue when processing web content can lead to an unexpected
process crash
  (bsc#1271638).
- CVE-2026-43745: out-of-bounds write issue when processing web content can lead to an unexpected
Safari crash
  (bsc#1271638).

Changes for webkit2gtk3:

- Update to version 2.52.5:

 * Fire scrollend event for instant programmatic scrolls.
 * Increase network idle connection timeout to 115 seconds.
 * Add User-Agent quirk for HBO Max.
 * Fix the build with system malloc.


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1420=1

Package List:

- openSUSE Leap 16.0:

  WebKitGTK-4.0-lang-2.52.5-160000.1.1
  WebKitGTK-4.1-lang-2.52.5-160000.1.1
  WebKitGTK-6.0-lang-2.52.5-160000.1.1
  libjavascriptcoregtk-4_0-18-2.52.5-160000.1.1
  libjavascriptcoregtk-4_1-0-2.52.5-160000.1.1
  libjavascriptcoregtk-6_0-1-2.52.5-160000.1.1
  libwebkit2gtk-4_0-37-2.52.5-160000.1.1
  libwebkit2gtk-4_1-0-2.52.5-160000.1.1
  libwebkitgtk-6_0-4-2.52.5-160000.1.1
  typelib-1_0-JavaScriptCore-4_0-2.52.5-160000.1.1
  typelib-1_0-JavaScriptCore-4_1-2.52.5-160000.1.1
  typelib-1_0-JavaScriptCore-6_0-2.52.5-160000.1.1
  typelib-1_0-WebKit-6_0-2.52.5-160000.1.1
  typelib-1_0-WebKit2-4_0-2.52.5-160000.1.1
  typelib-1_0-WebKit2-4_1-2.52.5-160000.1.1
  typelib-1_0-WebKit2WebExtension-4_0-2.52.5-160000.1.1
  typelib-1_0-WebKit2WebExtension-4_1-2.52.5-160000.1.1
  typelib-1_0-WebKitWebProcessExtension-6_0-2.52.5-160000.1.1
  webkit-jsc-4-2.52.5-160000.1.1
  webkit-jsc-4.1-2.52.5-160000.1.1
  webkit-jsc-6.0-2.52.5-160000.1.1
  webkit2gtk-4_0-injected-bundles-2.52.5-160000.1.1
  webkit2gtk-4_1-injected-bundles-2.52.5-160000.1.1
  webkit2gtk3-devel-2.52.5-160000.1.1
  webkit2gtk3-minibrowser-2.52.5-160000.1.1
  webkit2gtk3-soup2-devel-2.52.5-160000.1.1
  webkit2gtk3-soup2-minibrowser-2.52.5-160000.1.1
  webkit2gtk4-devel-2.52.5-160000.1.1
  webkit2gtk4-minibrowser-2.52.5-160000.1.1
  webkitgtk-6_0-injected-bundles-2.52.5-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2024-4367.html
  * https://www.suse.com/security/cve/CVE-2026-39872.html
  * https://www.suse.com/security/cve/CVE-2026-43663.html
  * https://www.suse.com/security/cve/CVE-2026-43676.html
  * https://www.suse.com/security/cve/CVE-2026-43699.html
  * https://www.suse.com/security/cve/CVE-2026-43701.html
  * https://www.suse.com/security/cve/CVE-2026-43705.html
  * https://www.suse.com/security/cve/CVE-2026-43707.html
  * https://www.suse.com/security/cve/CVE-2026-43712.html
  * https://www.suse.com/security/cve/CVE-2026-43713.html
  * https://www.suse.com/security/cve/CVE-2026-43715.html
  * https://www.suse.com/security/cve/CVE-2026-43716.html
  * https://www.suse.com/security/cve/CVE-2026-43720.html
  * https://www.suse.com/security/cve/CVE-2026-43721.html
  * https://www.suse.com/security/cve/CVE-2026-43725.html
  * https://www.suse.com/security/cve/CVE-2026-43726.html
  * https://www.suse.com/security/cve/CVE-2026-43727.html
  * https://www.suse.com/security/cve/CVE-2026-43731.html
  * https://www.suse.com/security/cve/CVE-2026-43732.html
  * https://www.suse.com/security/cve/CVE-2026-43734.html
  * https://www.suse.com/security/cve/CVE-2026-43740.html
  * https://www.suse.com/security/cve/CVE-2026-43742.html
  * https://www.suse.com/security/cve/CVE-2026-43745.html
to post comments


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds