Red Hat Product Errata RHSA-2025:19352 - Security Advisory
Issued:
2025-10-30
Updated:
2025-10-30

RHSA-2025:19352 - Security Advisory

Synopsis

Important: webkitgtk4 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.

Security Fix(es):

  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
  • webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

  • BZ - 2397626 - CVE-2025-43272 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
  • BZ - 2397627 - CVE-2025-43342 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2397628 - CVE-2025-43356 webkitgtk: A website may be able to access sensor information without user consent
  • BZ - 2397630 - CVE-2025-43368 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
webkitgtk4-2.50.0-1.el7_9.src.rpm SHA-256: c690b77e15b6f84f359c4416158e38a1d9ae1006e61cda725498609e97957901
x86_64
webkitgtk4-2.50.0-1.el7_9.x86_64.rpm SHA-256: ddef3aaa5dc56a00a711d815c41dfb62b8e4a95a08ec22ab479b7fcd7513d2cb
webkitgtk4-debuginfo-2.50.0-1.el7_9.x86_64.rpm SHA-256: 30fcad33911d910e28e77cee3f56bc02ae351ea93f67b663da18d346e9a3b23b
webkitgtk4-devel-2.50.0-1.el7_9.x86_64.rpm SHA-256: e7fe1525cfff5ccdc2b1f3f14edcdee2dc72bb1d6e3a40af5402aee54c5e7773
webkitgtk4-doc-2.50.0-1.el7_9.noarch.rpm SHA-256: 9af0eada353797609223295e88fbd265dcdc0b33e3012e255e622d63728bf9d4
webkitgtk4-jsc-2.50.0-1.el7_9.x86_64.rpm SHA-256: 143e960a7b43ae001456ee9046141a7c7ac29db59eff7d5a1326f7354026fd2a
webkitgtk4-jsc-devel-2.50.0-1.el7_9.x86_64.rpm SHA-256: 58f24704bd6fa1c5c9361f0ace59823959229f5be5179d6227788165358340c2

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
webkitgtk4-2.50.0-1.el7_9.src.rpm SHA-256: c690b77e15b6f84f359c4416158e38a1d9ae1006e61cda725498609e97957901
s390x
webkitgtk4-2.50.0-1.el7_9.s390x.rpm SHA-256: 626f41ed00ca470648505d29368ff664d7f54e5b79888368cf74111c8c585fc3
webkitgtk4-debuginfo-2.50.0-1.el7_9.s390x.rpm SHA-256: 5906d6fc68206156172bd041cf7d5a0e9993d2e544085726ffb8167d58595887
webkitgtk4-debuginfo-2.50.0-1.el7_9.s390x.rpm SHA-256: 5906d6fc68206156172bd041cf7d5a0e9993d2e544085726ffb8167d58595887
webkitgtk4-devel-2.50.0-1.el7_9.s390x.rpm SHA-256: 85bd8b7c90d25d5ba29542dfee4a748607f9de09226273dc0984e92651652f7a
webkitgtk4-doc-2.50.0-1.el7_9.noarch.rpm SHA-256: 9af0eada353797609223295e88fbd265dcdc0b33e3012e255e622d63728bf9d4
webkitgtk4-jsc-2.50.0-1.el7_9.s390x.rpm SHA-256: a9f010968450d2bdb3bd264df49993978c7a40755fdc106e26ffebcc48ec2fa6
webkitgtk4-jsc-devel-2.50.0-1.el7_9.s390x.rpm SHA-256: a7ab8ae61936216b863c470522e3eb43a839ff86f65a63c0a6655ec0315cfb92

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
webkitgtk4-2.50.0-1.el7_9.src.rpm SHA-256: c690b77e15b6f84f359c4416158e38a1d9ae1006e61cda725498609e97957901
ppc64
webkitgtk4-doc-2.50.0-1.el7_9.noarch.rpm SHA-256: 9af0eada353797609223295e88fbd265dcdc0b33e3012e255e622d63728bf9d4

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
webkitgtk4-2.50.0-1.el7_9.src.rpm SHA-256: c690b77e15b6f84f359c4416158e38a1d9ae1006e61cda725498609e97957901
ppc64le
webkitgtk4-2.50.0-1.el7_9.ppc64le.rpm SHA-256: c863e27442b4e0d613b78dc713ae614ea7f867bb34e90d8f6e9f04d8cfa1edf2
webkitgtk4-debuginfo-2.50.0-1.el7_9.ppc64le.rpm SHA-256: 648920bd00802a4b66c8411cbf7c0802a53480a0492012b7c11ffa0b79593978
webkitgtk4-devel-2.50.0-1.el7_9.ppc64le.rpm SHA-256: b559ebce4e96537b92c7758cacbf1218aff23a78382aa7b2435e922e526fa09c
webkitgtk4-doc-2.50.0-1.el7_9.noarch.rpm SHA-256: 9af0eada353797609223295e88fbd265dcdc0b33e3012e255e622d63728bf9d4
webkitgtk4-jsc-2.50.0-1.el7_9.ppc64le.rpm SHA-256: 0694b032ee3284bac329e3bef3a8f3dfcc7ea4b9b3fcba47880b02270bd6726a
webkitgtk4-jsc-devel-2.50.0-1.el7_9.ppc64le.rpm SHA-256: 7213510f130a409f6fd793a15ffbc1268f25dcab6a073d79b23cdd07eff062c8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.