Red Hat Product Errata RHSA-2025:23451 - Security Advisory
Issued:
2025-12-17
Updated:
2025-12-17

RHSA-2025:23451 - Security Advisory

Synopsis

Important: webkit2gtk3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
  • webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
  • webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
  • webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 9.2 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x

Fixes

  • BZ - 2416300 - CVE-2025-13502 webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS
  • BZ - 2416325 - CVE-2025-43392 webkitgtk: A website may exfiltrate image data cross-origin
  • BZ - 2416327 - CVE-2025-43425 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416329 - CVE-2025-43427 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416330 - CVE-2025-43429 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416331 - CVE-2025-43430 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416332 - CVE-2025-43431 webkitgtk: Processing maliciously crafted web content may lead to memory corruption
  • BZ - 2416334 - CVE-2025-43432 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416335 - CVE-2025-43434 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
  • BZ - 2416336 - CVE-2025-43440 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416337 - CVE-2025-43443 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416355 - CVE-2025-43421 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2418576 - CVE-2025-13947 webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop
  • BZ - 2418855 - CVE-2025-43458 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2418857 - CVE-2025-66287 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

Red Hat Enterprise Linux Server - AUS 9.2

SRPM
webkit2gtk3-2.50.3-1.el9_2.src.rpm SHA-256: 0bc344d2a6d3931e24f1180599f09a808c404d0285903f1fbebb2504db157edb
x86_64
webkit2gtk3-2.50.3-1.el9_2.i686.rpm SHA-256: 8e6e00e3bf6d9f2dbdd6a2936a6003b79e6cb81106bb537dd61afd1c3952b840
webkit2gtk3-2.50.3-1.el9_2.x86_64.rpm SHA-256: ce62bcf3d65641cd3ca45b99b38ecf88379896f6d319ee21b735abc9281ec65e
webkit2gtk3-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: ccd07304e7ff266fba6e3bcc232753683607606619ff8cc8dbabfa2aba6e9771
webkit2gtk3-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: 365373b171fe14cba06c0984d60958717e7aabb46cb717f041e9553d39a8d99e
webkit2gtk3-debugsource-2.50.3-1.el9_2.i686.rpm SHA-256: cbb9c09906f7dd92a530f3402bf2d1639fab5c6bf594efaecf8bdc4e280b2aad
webkit2gtk3-debugsource-2.50.3-1.el9_2.x86_64.rpm SHA-256: f2f598d07b3866860f33ac111179ed30614d267ce2eb3bf6e589cc652aad1e6a
webkit2gtk3-devel-2.50.3-1.el9_2.i686.rpm SHA-256: 55f52790a922d811617e38e2981a13f5367b84b5fbb2bcd162f68eeb611d973a
webkit2gtk3-devel-2.50.3-1.el9_2.x86_64.rpm SHA-256: 5e2c3d39fa053066b85e7882d236a4b6a301ecf5d377d5258aa664ce8235aa11
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: 45ec50a90461672cd1b8ef7317d273d7b4aec501ad284fee97ff0fa8a073f19a
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: d3a6320cb0c3cd3ba5cdd44307394473f8b07dd5caee06420e570a6ae6626d17
webkit2gtk3-jsc-2.50.3-1.el9_2.i686.rpm SHA-256: 636270a8ccf1bec6febdbeecae27dfb9cf1a9110520605d5336626293d9b3b2d
webkit2gtk3-jsc-2.50.3-1.el9_2.x86_64.rpm SHA-256: 1e3541a786b1394cd0eadbaee6227d4cb8afad8835c8a4bfad13e1e57bf87da6
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: ceccd8da5a0efc2f3b192d00c2c50bc495297bfa0de8f602ee13f8d48992d23b
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: 6ac8bfe4ea308fff3aac88645a4439fa991fa78ee27b966d7b55c5650638ee92
webkit2gtk3-jsc-devel-2.50.3-1.el9_2.i686.rpm SHA-256: 2d548aa2677cf8ad30c51c3235a9a6860e7b2b7858c2cefdc4dc954ff1c1c6a0
webkit2gtk3-jsc-devel-2.50.3-1.el9_2.x86_64.rpm SHA-256: ffbecb883a5c830c10cafc09eb857994c6848c02310e12d2b6ccf65ecb762b40
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: 92a7c6572c5cb3092788494514d178be1df017b0c2ea94d1b01daf4a59a87ed7
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: 4f26f38ca3de8670b92240011ca202d832e3259103a02283698ba0a4024d83db

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2

SRPM
webkit2gtk3-2.50.3-1.el9_2.src.rpm SHA-256: 0bc344d2a6d3931e24f1180599f09a808c404d0285903f1fbebb2504db157edb
ppc64le
webkit2gtk3-2.50.3-1.el9_2.ppc64le.rpm SHA-256: 2a3238dd34e9e892bfa12c4d990de7f7b430cb1e38e350daaf1b965586438801
webkit2gtk3-debuginfo-2.50.3-1.el9_2.ppc64le.rpm SHA-256: 5c484e7d50a576f1e59098a7397cfed10082213bff8adf6c34e2f575a504245a
webkit2gtk3-debugsource-2.50.3-1.el9_2.ppc64le.rpm SHA-256: 29086f13eadd174e50f50c98a85c788c8316c7eacfaefdfa6293ec1805650928
webkit2gtk3-devel-2.50.3-1.el9_2.ppc64le.rpm SHA-256: a9c75ad9f83caf6d101e3eb6ad3dae98bf700cab29c6c79e61035dba02959dea
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_2.ppc64le.rpm SHA-256: b1cdb883756a6da584532245b5822b0821293caf5eb3dd79e9b954c91e9f2037
webkit2gtk3-jsc-2.50.3-1.el9_2.ppc64le.rpm SHA-256: 8d24105ede401c718156ba5611a8a8bf7500eecab7dc474f2fc6258316fbe7be
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_2.ppc64le.rpm SHA-256: 1461189e477327f8da717a9b7d0acd271bd88119d460355e6126bcd4c3024aba
webkit2gtk3-jsc-devel-2.50.3-1.el9_2.ppc64le.rpm SHA-256: 2d26bda23d9e5c8645f2a7922784a0bc71a444d072bed9a22bbaa9ffbe651ef5
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_2.ppc64le.rpm SHA-256: 9a68570dc5391215627f9321d0073efd4dde53353481088988acbdd45b15fdd4

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2

SRPM
webkit2gtk3-2.50.3-1.el9_2.src.rpm SHA-256: 0bc344d2a6d3931e24f1180599f09a808c404d0285903f1fbebb2504db157edb
x86_64
webkit2gtk3-2.50.3-1.el9_2.i686.rpm SHA-256: 8e6e00e3bf6d9f2dbdd6a2936a6003b79e6cb81106bb537dd61afd1c3952b840
webkit2gtk3-2.50.3-1.el9_2.x86_64.rpm SHA-256: ce62bcf3d65641cd3ca45b99b38ecf88379896f6d319ee21b735abc9281ec65e
webkit2gtk3-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: ccd07304e7ff266fba6e3bcc232753683607606619ff8cc8dbabfa2aba6e9771
webkit2gtk3-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: 365373b171fe14cba06c0984d60958717e7aabb46cb717f041e9553d39a8d99e
webkit2gtk3-debugsource-2.50.3-1.el9_2.i686.rpm SHA-256: cbb9c09906f7dd92a530f3402bf2d1639fab5c6bf594efaecf8bdc4e280b2aad
webkit2gtk3-debugsource-2.50.3-1.el9_2.x86_64.rpm SHA-256: f2f598d07b3866860f33ac111179ed30614d267ce2eb3bf6e589cc652aad1e6a
webkit2gtk3-devel-2.50.3-1.el9_2.i686.rpm SHA-256: 55f52790a922d811617e38e2981a13f5367b84b5fbb2bcd162f68eeb611d973a
webkit2gtk3-devel-2.50.3-1.el9_2.x86_64.rpm SHA-256: 5e2c3d39fa053066b85e7882d236a4b6a301ecf5d377d5258aa664ce8235aa11
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: 45ec50a90461672cd1b8ef7317d273d7b4aec501ad284fee97ff0fa8a073f19a
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: d3a6320cb0c3cd3ba5cdd44307394473f8b07dd5caee06420e570a6ae6626d17
webkit2gtk3-jsc-2.50.3-1.el9_2.i686.rpm SHA-256: 636270a8ccf1bec6febdbeecae27dfb9cf1a9110520605d5336626293d9b3b2d
webkit2gtk3-jsc-2.50.3-1.el9_2.x86_64.rpm SHA-256: 1e3541a786b1394cd0eadbaee6227d4cb8afad8835c8a4bfad13e1e57bf87da6
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: ceccd8da5a0efc2f3b192d00c2c50bc495297bfa0de8f602ee13f8d48992d23b
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: 6ac8bfe4ea308fff3aac88645a4439fa991fa78ee27b966d7b55c5650638ee92
webkit2gtk3-jsc-devel-2.50.3-1.el9_2.i686.rpm SHA-256: 2d548aa2677cf8ad30c51c3235a9a6860e7b2b7858c2cefdc4dc954ff1c1c6a0
webkit2gtk3-jsc-devel-2.50.3-1.el9_2.x86_64.rpm SHA-256: ffbecb883a5c830c10cafc09eb857994c6848c02310e12d2b6ccf65ecb762b40
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_2.i686.rpm SHA-256: 92a7c6572c5cb3092788494514d178be1df017b0c2ea94d1b01daf4a59a87ed7
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_2.x86_64.rpm SHA-256: 4f26f38ca3de8670b92240011ca202d832e3259103a02283698ba0a4024d83db

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2

SRPM
webkit2gtk3-2.50.3-1.el9_2.src.rpm SHA-256: 0bc344d2a6d3931e24f1180599f09a808c404d0285903f1fbebb2504db157edb
aarch64
webkit2gtk3-2.50.3-1.el9_2.aarch64.rpm SHA-256: 42ba8f285c7eb86b8962137b91e141bca35c3463c7d3320aa291cc0df8ec9b4f
webkit2gtk3-debuginfo-2.50.3-1.el9_2.aarch64.rpm SHA-256: 4e6f1adb7de9d4980bedfca07dd6a0039389ea8ee24907799b7fcfc3ce84bc9b
webkit2gtk3-debugsource-2.50.3-1.el9_2.aarch64.rpm SHA-256: a246652b99f897761b968c72a77ff2f7ebef2fefba534ed64adbdb0638bbe409
webkit2gtk3-devel-2.50.3-1.el9_2.aarch64.rpm SHA-256: 910f96cd369dd8d78e8b34699e8eb6efee65fc0f3e906c46fc5ce1df71db33c0
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_2.aarch64.rpm SHA-256: 22605c6cf986ca70d4b81b20571a128a4db05d601d2a8be7bd75a06f46bf8e32
webkit2gtk3-jsc-2.50.3-1.el9_2.aarch64.rpm SHA-256: fb01c9e6810b551a0d2ffc3ef535af01fba2299cd8fcd15eb923390499d653f1
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_2.aarch64.rpm SHA-256: b97c64059e301a8d4aae3ba041bdef334f37bfd97cde27a38873c9f63bf3d37f
webkit2gtk3-jsc-devel-2.50.3-1.el9_2.aarch64.rpm SHA-256: d46076e924264945451e3432aa2ea7335478ad959c9d129b330a93351bab619c
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_2.aarch64.rpm SHA-256: 22c8e6e9e302969c0c6524637942ce2dd1e92c08b3371001daa096d4545898e3

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2

SRPM
webkit2gtk3-2.50.3-1.el9_2.src.rpm SHA-256: 0bc344d2a6d3931e24f1180599f09a808c404d0285903f1fbebb2504db157edb
s390x
webkit2gtk3-2.50.3-1.el9_2.s390x.rpm SHA-256: 46b380e096ccd74d2ed308e89ff4e3abd886b9f3832b048dba70ecb12dd4abd2
webkit2gtk3-debuginfo-2.50.3-1.el9_2.s390x.rpm SHA-256: 4fdd8a6240221079da3d7927f8e9d59e41bfea79b087843084a58984d04f3df3
webkit2gtk3-debugsource-2.50.3-1.el9_2.s390x.rpm SHA-256: d006512f9a92fec375761f5dcc810b886773aff57d7d307cfda55f1141567e9a
webkit2gtk3-devel-2.50.3-1.el9_2.s390x.rpm SHA-256: 754bbdc0e4e81537ebb86892959cb363b45071010f75465a1853572d8c929199
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_2.s390x.rpm SHA-256: ef6f8e0b41448daa233220918e99cb91f7236b2f45b8d08c8cf1027d09d7190e
webkit2gtk3-jsc-2.50.3-1.el9_2.s390x.rpm SHA-256: bd7da92ce5693e6d07f63d8d9acc5d594bc4ecf44f0cba2ead333d93647df88a
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_2.s390x.rpm SHA-256: 3159c9d173d7f0fccb0d659d6090c19ea2699d775d980576f2ea15d8eda997b3
webkit2gtk3-jsc-devel-2.50.3-1.el9_2.s390x.rpm SHA-256: 37fad53c3e144abe1741c58b4af7745fc7cfa90fd1c0ec1335d7af2953a50d8e
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_2.s390x.rpm SHA-256: e7e4a65851548caa5839641a7bcf79686209e474680613731809087579e8ade0

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.