Red Hat Product Errata RHSA-2025:22790 - Security Advisory
Issued:
2025-12-08
Updated:
2025-12-08

RHSA-2025:22790 - Security Advisory

Synopsis

Important: webkit2gtk3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
  • webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
  • webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
  • webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
  • webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
  • webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
  • webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2416300 - CVE-2025-13502 webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS
  • BZ - 2416324 - CVE-2023-43000 webkitgtk: Processing maliciously crafted web content may lead to memory corruption
  • BZ - 2416325 - CVE-2025-43392 webkitgtk: A website may exfiltrate image data cross-origin
  • BZ - 2416326 - CVE-2025-43419 webkitgtk: Processing maliciously crafted web content may lead to memory corruption
  • BZ - 2416327 - CVE-2025-43425 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416329 - CVE-2025-43427 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416330 - CVE-2025-43429 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416331 - CVE-2025-43430 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416332 - CVE-2025-43431 webkitgtk: Processing maliciously crafted web content may lead to memory corruption
  • BZ - 2416334 - CVE-2025-43432 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416335 - CVE-2025-43434 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
  • BZ - 2416336 - CVE-2025-43440 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416337 - CVE-2025-43443 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416338 - CVE-2025-43480 webkitgtk: A malicious website may exfiltrate data cross-origin
  • BZ - 2416355 - CVE-2025-43421 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2418576 - CVE-2025-13947 webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop
  • BZ - 2418855 - CVE-2025-43458 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2418857 - CVE-2025-66287 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

Red Hat Enterprise Linux for x86_64 9

SRPM
webkit2gtk3-2.50.3-1.el9_7.src.rpm SHA-256: b279977826e07f0a407e17852315acf20a4038aa7e5bb71069c3dc74696c14d2
x86_64
webkit2gtk3-2.50.3-1.el9_7.i686.rpm SHA-256: ea052405c87d0ce8d33fc4355c8b15f2d97c5f32c4c0c5ad1ab6d118828eceb2
webkit2gtk3-2.50.3-1.el9_7.x86_64.rpm SHA-256: 6b285267e8402e3f29e9d057c624e9fd2fcad907c1132669126e4eee9f471835
webkit2gtk3-debuginfo-2.50.3-1.el9_7.i686.rpm SHA-256: 1c6fe62e9a614adf8b049693c0894b09e7b1380e2ff0a703cb029e2df106ec97
webkit2gtk3-debuginfo-2.50.3-1.el9_7.x86_64.rpm SHA-256: c76d47798e82e5adb482de5729ef3a91c3f45be2f9dbc20bc238dc8b7a8a45fe
webkit2gtk3-debugsource-2.50.3-1.el9_7.i686.rpm SHA-256: cb6271be58b3fca8e1429670ed245a38c0bacbfeab59f552fed930a45cebdcb2
webkit2gtk3-debugsource-2.50.3-1.el9_7.x86_64.rpm SHA-256: dd2c183126ae7dc8b34bda1b004d2c6daf4c12c328584c487c9ddb00187e669a
webkit2gtk3-devel-2.50.3-1.el9_7.i686.rpm SHA-256: 728dded50b20281d2ddc7a07724f9618d47ff0e0a4ffd6a886b0b294c671860b
webkit2gtk3-devel-2.50.3-1.el9_7.x86_64.rpm SHA-256: 358ec4e382cb3707a8ab1b6b576593d00ad9982d7e52ad997b2c74b6b29fbeb3
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_7.i686.rpm SHA-256: 5ef16110e3be72059bfaba55ab91d6c13a24dbbdc77af51791896178d13e6d73
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_7.x86_64.rpm SHA-256: a12b3358b47873137b37ede57565e2d8dcca556a42926c553707cb1ee331aad9
webkit2gtk3-jsc-2.50.3-1.el9_7.i686.rpm SHA-256: 66efef2a517df4ef63cb1e53dc7438054476e636bad3daf3a15e19ae4a465fee
webkit2gtk3-jsc-2.50.3-1.el9_7.x86_64.rpm SHA-256: e726d6be3f38e1a9fe96e41a15c0c625c9e7feb12ad28bbc5b332df6e868a269
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_7.i686.rpm SHA-256: 4beed1ba75c6b33e1623e90ec829fb57994a100ea358324f00e68b660d50008a
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_7.x86_64.rpm SHA-256: 7acb54e70fcebbddb6f55a4688edcb3c9b1515d76dbba6a936b9db94847417be
webkit2gtk3-jsc-devel-2.50.3-1.el9_7.i686.rpm SHA-256: 1db1600f6da9eec8da310caabb7a06df6118ee6ea5e84245be9ba328f770b984
webkit2gtk3-jsc-devel-2.50.3-1.el9_7.x86_64.rpm SHA-256: ad0b371c4cebff154456ba40316b9ae9c09fba93e112329515f24d3e5fddce57
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_7.i686.rpm SHA-256: 62bc7cf08669b3a8a073c5056f284c5e3e4363be32b65b1da0768d77a3cfdf74
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_7.x86_64.rpm SHA-256: f46aab86bf82b73e3a40c4afe6720adecc20b0022b1aa5295f5ea1bd2bc39968

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
webkit2gtk3-2.50.3-1.el9_7.src.rpm SHA-256: b279977826e07f0a407e17852315acf20a4038aa7e5bb71069c3dc74696c14d2
s390x
webkit2gtk3-2.50.3-1.el9_7.s390x.rpm SHA-256: 919e7066dff55d5dffc98c05b741cb76df7723e27fd2c38c4d67f7995f523ab6
webkit2gtk3-debuginfo-2.50.3-1.el9_7.s390x.rpm SHA-256: 8be327fc8db54f58cdc65dcffb81be704054804a801bcfbf4bc4d525aeca47f6
webkit2gtk3-debugsource-2.50.3-1.el9_7.s390x.rpm SHA-256: 236a5721c7ae9482df25c272ac2a771f3f0543b45cd30c02b429569b152ee00a
webkit2gtk3-devel-2.50.3-1.el9_7.s390x.rpm SHA-256: daf56c00d89017ff7e97f687336d6b6fc3203d17e4f1559a220a3c349e3e54e3
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_7.s390x.rpm SHA-256: eee83630260df86c9fca1f57b2fad5c5cd8e4edf371156058bf391e1cb563092
webkit2gtk3-jsc-2.50.3-1.el9_7.s390x.rpm SHA-256: 166fb4c55d5f406ff725acf84298c3ba7bd1ef0d540080faec9fd37dad17da2f
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_7.s390x.rpm SHA-256: 4af6ed3b534756442ad0e617bd97a9e45ba028cc103509a742b2a19350995b76
webkit2gtk3-jsc-devel-2.50.3-1.el9_7.s390x.rpm SHA-256: ea90fe1ce97f1666537cc4d4611bc1b6f4c4039b3b7d969fab31ded51ee8b567
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_7.s390x.rpm SHA-256: 0285613a581b67edb61e3372ae0516cfd2c18867dd69bbfbc96463b7a8b1094b

Red Hat Enterprise Linux for Power, little endian 9

SRPM
webkit2gtk3-2.50.3-1.el9_7.src.rpm SHA-256: b279977826e07f0a407e17852315acf20a4038aa7e5bb71069c3dc74696c14d2
ppc64le
webkit2gtk3-2.50.3-1.el9_7.ppc64le.rpm SHA-256: 3ebaee5c8c8efca87d98b242e3d8c492ee74ef412cdf1084b1308ed34bf563e3
webkit2gtk3-debuginfo-2.50.3-1.el9_7.ppc64le.rpm SHA-256: dcd308ec33f49ec313c31fb685759e5634b0002b3bcfa01fd19c5fbac9dbb2a7
webkit2gtk3-debugsource-2.50.3-1.el9_7.ppc64le.rpm SHA-256: 965bde24fdaafe04627f6f9b14b3009eb58b72cc5ff70bd99d4cb61bf18b85ff
webkit2gtk3-devel-2.50.3-1.el9_7.ppc64le.rpm SHA-256: 4a3b482ed74f722e7398e8abe56f5c0cbeeed68139fe6aec2ab8c209c47842df
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_7.ppc64le.rpm SHA-256: 01ea0361f7c916cb95ec017ec224f32903a009f7239bf0113f5241c50e80550d
webkit2gtk3-jsc-2.50.3-1.el9_7.ppc64le.rpm SHA-256: a19aa4dc90bd2c428baf9ad249788333360a7397898892e8f38a6df5b4a57601
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_7.ppc64le.rpm SHA-256: 3c3b802464a1bbdda4c96bed2a0dabc8ac59e959d0cd7371629b543099d22d70
webkit2gtk3-jsc-devel-2.50.3-1.el9_7.ppc64le.rpm SHA-256: 771a51aa63f1284e106bcbbf4cd56f7858fc3117b0e18574098420bfd6b339e6
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_7.ppc64le.rpm SHA-256: dcbe794bf2d22160bea10430a3fb6b2d2d5411d2fd983c30540f31794cfb5b54

Red Hat Enterprise Linux for ARM 64 9

SRPM
webkit2gtk3-2.50.3-1.el9_7.src.rpm SHA-256: b279977826e07f0a407e17852315acf20a4038aa7e5bb71069c3dc74696c14d2
aarch64
webkit2gtk3-2.50.3-1.el9_7.aarch64.rpm SHA-256: ae577d09a708743b0d685ef85c262c46a92c5eaf5c4e3c623d933aac08127bc0
webkit2gtk3-debuginfo-2.50.3-1.el9_7.aarch64.rpm SHA-256: bc14841e0fffa92a93484b1393c131f993d947f4c28b9ab93f5876bb27899347
webkit2gtk3-debugsource-2.50.3-1.el9_7.aarch64.rpm SHA-256: 30b5a18fe45f7a6fa5ad5bbb258129fa4b12ec2c718d6d221fb27253c7c37420
webkit2gtk3-devel-2.50.3-1.el9_7.aarch64.rpm SHA-256: f147cdec0f404005e04a165c498c9365b5ca15d13c37f0bdd49ae5c6067028ce
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_7.aarch64.rpm SHA-256: cf8ec8b370ea544a215130b2a8ade9e9f8aee717fc6a05f09af31d3418274c8c
webkit2gtk3-jsc-2.50.3-1.el9_7.aarch64.rpm SHA-256: 840ad8cbbbbbde2f18b04dc51c1ddf073961236f8e3322bc5c2aa09cd0652d62
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_7.aarch64.rpm SHA-256: 1600d368fd10f34698a3b7eafe4599f47dd387a95a2c2fac582ae6b5ab3f8988
webkit2gtk3-jsc-devel-2.50.3-1.el9_7.aarch64.rpm SHA-256: 03ad1c35e69c5c10ae6318a1022da7c20339a15b724c730f376503876f730c39
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_7.aarch64.rpm SHA-256: e2f148abf9127bf12a768c19b570b13b4874e9318ab3a742042c4baa05532386

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.