Описание
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
Update to version 2.52.0.
Security issues fixed:
- CVE-2023-43010: processing maliciously crafted web content may lead to memory corruption (bsc#1259950).
- CVE-2025-31223: processing maliciously crafted web content may lead to memory corruption (bsc#1259949).
- CVE-2025-31277: processing maliciously crafted web content may lead to memory corruption (bsc#1259948).
- CVE-2025-43213: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259947).
- CVE-2025-43214: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259946).
- CVE-2025-43433: processing maliciously crafted web content may lead to memory corruption (bsc#1259945).
- CVE-2025-43438: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259944).
- CVE-2025-43441: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259943).
- CVE-2025-43457: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259942).
- CVE-2025-43511: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259941).
- CVE-2025-46299: processing maliciously crafted web content may disclose internal states of an app (bsc#1259940).
- CVE-2026-20608: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259939).
- CVE-2026-20635: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259938).
- CVE-2026-20636: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259937).
- CVE-2026-20643: processing maliciously crafted web content may bypass Same Origin Policy (bsc#1261172).
- CVE-2026-20644: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259936).
- CVE-2026-20652: a remote attacker may be able to cause a denial-of-service (bsc#1259935).
- CVE-2026-20664: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1261173).
- CVE-2026-20665: processing maliciously crafted web content may prevent Content Security Policy from being enforced (bsc#1261174).
- CVE-2026-20676: a website may be able to track users through web extensions (bsc#1259934).
- CVE-2026-20691: a maliciously crafted webpage may be able to fingerprint the user (bsc#1261175).
- CVE-2026-28857: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1261176).
- CVE-2026-28859: a malicious website may be able to process restricted web content outside the sandbox (bsc#1261177).
- CVE-2026-28861: a malicious website may be able to access script message handlers intended for other origins (bsc#1261178).
- CVE-2026-28871: visiting a maliciously crafted website may lead to a cross-site scripting attack (bsc#1261179).
Other updates and bugfixes:
- Make scrolling with touch input smoother for small movements.
- Fix estimated load progress of downloads when Content-Length value is wrong.
- Ensure that 'scrollend' events are correctly emitted after scroll animations.
- Reduce the amount of useless MPRIS notifications produced by MediaSession when the information about media being played is incomplete.
- Support turning off USE_GSTREAMER to configure the build with all multimedia features disabled.
- Add Sysprof marks for mouse events.
- Fix MediaSession icon for iheart.com not being displayed.
- Fix the build with USE_GSTREAMER_GL disabled.
- Fix the build with librice version 0.3.0 or newer.
- Fix several crashes and rendering issues.
- Translation updates: Georgian.
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Desktop Applications 15 SP7
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2026:1364-1
- E-Mail link for SUSE-SU-2026:1364-1
- SUSE Security Ratings
- SUSE Bug 1259934
- SUSE Bug 1259935
- SUSE Bug 1259936
- SUSE Bug 1259937
- SUSE Bug 1259938
- SUSE Bug 1259939
- SUSE Bug 1259940
- SUSE Bug 1259941
- SUSE Bug 1259942
- SUSE Bug 1259943
- SUSE Bug 1259944
- SUSE Bug 1259945
- SUSE Bug 1259946
- SUSE Bug 1259947
- SUSE Bug 1259948
- SUSE Bug 1259949
- SUSE Bug 1259950
Описание
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.
Затронутые продукты
Ссылки
- CVE-2023-43010
- SUSE Bug 1259950
Описание
The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.
Затронутые продукты
Ссылки
- CVE-2025-31223
- SUSE Bug 1259949
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Затронутые продукты
Ссылки
- CVE-2025-31277
- SUSE Bug 1259948
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Затронутые продукты
Ссылки
- CVE-2025-43213
- SUSE Bug 1259947
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Затронутые продукты
Ссылки
- CVE-2025-43214
- SUSE Bug 1259946
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption.
Затронутые продукты
Ссылки
- CVE-2025-43433
- SUSE Bug 1259945
Описание
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Затронутые продукты
Ссылки
- CVE-2025-43438
- SUSE Bug 1259944
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2025-43441
- SUSE Bug 1259943
Описание
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Затронутые продукты
Ссылки
- CVE-2025-43457
- SUSE Bug 1259942
Описание
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2025-43511
- SUSE Bug 1259941
Описание
A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may disclose internal states of the app.
Затронутые продукты
Ссылки
- CVE-2025-46299
- SUSE Bug 1259940
Описание
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2026-20608
- SUSE Bug 1259939
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2026-20635
- SUSE Bug 1259938
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2026-20636
- SUSE Bug 1259937
Описание
A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.
Затронутые продукты
Ссылки
- CVE-2026-20643
- SUSE Bug 1261172
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2026-20644
- SUSE Bug 1259936
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service.
Затронутые продукты
Ссылки
- CVE-2026-20652
- SUSE Bug 1259935
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2026-20664
- SUSE Bug 1261173
Описание
This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
Затронутые продукты
Ссылки
- CVE-2026-20665
- SUSE Bug 1261174
Описание
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions.
Затронутые продукты
Ссылки
- CVE-2026-20676
- SUSE Bug 1259934
Описание
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A maliciously crafted webpage may be able to fingerprint the user.
Затронутые продукты
Ссылки
- CVE-2026-20691
- SUSE Bug 1261175
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
Затронутые продукты
Ссылки
- CVE-2026-28857
- SUSE Bug 1261176
Описание
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A malicious website may be able to process restricted web content outside the sandbox.
Затронутые продукты
Ссылки
- CVE-2026-28859
- SUSE Bug 1261177
Описание
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
Затронутые продукты
Ссылки
- CVE-2026-28861
- SUSE Bug 1261178
Описание
A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.
Затронутые продукты
Ссылки
- CVE-2026-28871
- SUSE Bug 1261179