Debian alert DSA-6534-1 (webkit2gtk)

From:
             
 
Alberto Garcia <berto@debian.org>
To:
             
 
debian-security-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DSA 6534-1] webkit2gtk security update
Date:
             
 
Thu, 01 Oct 2026 14:40:43 +0000
Message-ID:
             
 
<ar5w63IevrhXlczg@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6534-1                   security@debian.org
https://www.debian.org/security/                           Alberto Garcia
October 01, 2026                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : webkit2gtk
CVE ID         : CVE-2024-1283 CVE-2024-7966 CVE-2024-8193 CVE-2024-8198
                 CVE-2024-8636 CVE-2024-9123 CVE-2024-43091 CVE-2024-43097
                 CVE-2024-43767 CVE-2024-43768 CVE-2025-0436 CVE-2025-0444
                 CVE-2025-8901 CVE-2025-9478 CVE-2025-10502 CVE-2025-26416
                 CVE-2025-32318 CVE-2025-48622 CVE-2025-54627 CVE-2026-0908
                 CVE-2026-3536 CVE-2026-3538 CVE-2026-3909 CVE-2026-3931
                 CVE-2026-4448 CVE-2026-4460 CVE-2026-4464 CVE-2026-5283
                 CVE-2026-5870 CVE-2026-6296 CVE-2026-6298 CVE-2026-6364
                 CVE-2026-7353 CVE-2026-7354 CVE-2026-7359 CVE-2026-7900
                 CVE-2026-7920 CVE-2026-7923 CVE-2026-7942 CVE-2026-7943
                 CVE-2026-7949 CVE-2026-8579 CVE-2026-9877 CVE-2026-9878
                 CVE-2026-9879 CVE-2026-9882 CVE-2026-9893 CVE-2026-9899
                 CVE-2026-9900 CVE-2026-9901 CVE-2026-9904 CVE-2026-9908
                 CVE-2026-9909 CVE-2026-9910 CVE-2026-9911 CVE-2026-9913
                 CVE-2026-9914 CVE-2026-9915 CVE-2026-9916 CVE-2026-9923
                 CVE-2026-9925 CVE-2026-9926 CVE-2026-9927 CVE-2026-9935
                 CVE-2026-9940 CVE-2026-9941 CVE-2026-9942 CVE-2026-9944
                 CVE-2026-9946 CVE-2026-9953 CVE-2026-9965 CVE-2026-9969
                 CVE-2026-9975 CVE-2026-9981 CVE-2026-9982 CVE-2026-9983
                 CVE-2026-9998 CVE-2026-10009 CVE-2026-10011 CVE-2026-10012
                 CVE-2026-10018 CVE-2026-10019 CVE-2026-10881 CVE-2026-10883
                 CVE-2026-10889 CVE-2026-10907 CVE-2026-10919 CVE-2026-10941
                 CVE-2026-10974 CVE-2026-10977 CVE-2026-10979 CVE-2026-10985
                 CVE-2026-10993 CVE-2026-10994 CVE-2026-11004 CVE-2026-11024
                 CVE-2026-11039 CVE-2026-11040 CVE-2026-11051 CVE-2026-11057
                 CVE-2026-11061 CVE-2026-11065 CVE-2026-11066 CVE-2026-11087
                 CVE-2026-11088 CVE-2026-11090 CVE-2026-11104 CVE-2026-11109
                 CVE-2026-11110 CVE-2026-11111 CVE-2026-11113 CVE-2026-11121
                 CVE-2026-11123 CVE-2026-11124 CVE-2026-11137 CVE-2026-11138
                 CVE-2026-11159 CVE-2026-11191 CVE-2026-11663 CVE-2026-11675
                 CVE-2026-13780 CVE-2026-13781 CVE-2026-13834 CVE-2026-13841
                 CVE-2026-13859 CVE-2026-13877 CVE-2026-13883 CVE-2026-13971
                 CVE-2026-14044 CVE-2026-14125 CVE-2026-14152 CVE-2026-14382
                 CVE-2026-14386 CVE-2026-14387 CVE-2026-14388 CVE-2026-14389
                 CVE-2026-14390 CVE-2026-14396 CVE-2026-14398 CVE-2026-14400
                 CVE-2026-14410 CVE-2026-14411 CVE-2026-14412 CVE-2026-14413
                 CVE-2026-14414 CVE-2026-14418 CVE-2026-14419 CVE-2026-14425
                 CVE-2026-14427 CVE-2026-14429 CVE-2026-15109 CVE-2026-15766
                 CVE-2026-15774 CVE-2026-16413 CVE-2026-16417 CVE-2026-17653
                 CVE-2026-17655 CVE-2026-17667 CVE-2026-17668 CVE-2026-17671
                 CVE-2026-17675 CVE-2026-17678 CVE-2026-17682 CVE-2026-17683
                 CVE-2026-17687 CVE-2026-17689 CVE-2026-17697 CVE-2026-17702
                 CVE-2026-17704 CVE-2026-17714 CVE-2026-17717 CVE-2026-17718
                 CVE-2026-17721 CVE-2026-17740 CVE-2026-17745 CVE-2026-17750
                 CVE-2026-17757 CVE-2026-17771 CVE-2026-17785 CVE-2026-17801
                 CVE-2026-17832 CVE-2026-17847 CVE-2026-17914 CVE-2026-19160
                 CVE-2026-19161 CVE-2026-19173 CVE-2026-19176 CVE-2026-43670
                 CVE-2026-64715 CVE-2026-64753 CVE-2026-64778 CVE-2026-64779
                 CVE-2026-64780 CVE-2026-64781 CVE-2026-64782 CVE-2026-64784
                 CVE-2026-65331 CVE-2026-65332 CVE-2026-65333 CVE-2026-65334
                 CVE-2026-65336 CVE-2026-65337 CVE-2026-65338 CVE-2026-65340
                 CVE-2026-65341 CVE-2026-65351 CVE-2026-76041 CVE-2026-78904
                 CVE-2026-78905 CVE-2026-78906 CVE-2026-78914 CVE-2026-78958
                 CVE-2026-78965 CVE-2026-79020 CVE-2026-79043 CVE-2026-79112
                 CVE-2026-79118 CVE-2026-79120 CVE-2026-79127 CVE-2026-79130
                 CVE-2026-79131 CVE-2026-79144 CVE-2026-79147 CVE-2026-79149
                 CVE-2026-79188 CVE-2026-79189 CVE-2026-79229 CVE-2026-79269
                 CVE-2026-79270 CVE-2026-79275 CVE-2026-84635 CVE-2026-86898

Several vulnerabilities have been discovered in the WebKitGTK web
engine, that may lead to heap corruption, local privilege escalation,
remote code execution, out-of-bounds memory access, cross-origin data
leak and sandbox escape, among other problems.

See the WebKitGTK security advisory for details on each vulnerability:
https://webkitgtk.org/security/WSA-2026-0006.html

For the stable distribution (trixie), these problems have been fixed in
version 2.54.0-1~deb13u1.

We recommend that you upgrade your webkit2gtk packages.

For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmq+b6wACgkQAAyEYu0C
2AIDNA/+MOaahHdFS7udyIddNNnySwB3Uy3NT6I6ZwAw2tckya8SvnJWRpQT7rHk
F4GpCr6JPvfsJemTX8mXkGgcpBrL3aEyOkAtSC1usg1T04Vn/0ySWO6zlhLACMIY
xoy8aC5pdjYhkB6tkFbRv/RghaLeTnMI++3bI0OtJSI0jG/DuZUw2g9sClGDPkZL
wMU9riHs5pHmrO4oUai8KleepYxcVF0a8wo5abGWp5Ot00KAZR4zlJowBzMIsPQH
vjVnEeWaT8HdW4MvDv7ndmmkWDaHmdLOBWg5Si3/7r1Ha237NsTRaMqM/1BFUn0V
TznJn48e/Tw1DFTV1nOlKz7gGlpuRts0rNLO6qoBpemeht+qVzYd2KiurMKSUFQX
zy8iJTWPN0l4/qjcWX4GOlP0zjv7wP65n8ri1B75/bbQkb9t1M6avTXAztKMZFYm
02s0XU7PEJfT1AuT8brm+0KgZKwJO3N6asggRbiauyqGVnqxiA0fAS+lfQBlOOLH
M9A16M1zGmoYXSPFgYzxRUrRcccr3Ogbt4G6d2RUhJcsgFUKK7qINKQxWjv4Gx4j
nMBPN8+a2RCq736R885vNxRZVdWyNEvE5cyVuguvDi29f9baChwe3bnhJmVikhRp
tp4PktnR+6UefUg7oARTyE2BLHDQy7BCSHN0hKeFfrvfRXFwdjc=
=hlER
-----END PGP SIGNATURE-----