Red Hat Product Errata RHSA-2025:23452 - Security Advisory
Issued:
2025-12-17
Updated:
2025-12-17

RHSA-2025:23452 - Security Advisory

Synopsis

Important: webkit2gtk3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
  • webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
  • webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
  • webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x

Fixes

  • BZ - 2416300 - CVE-2025-13502 webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS
  • BZ - 2416325 - CVE-2025-43392 webkitgtk: A website may exfiltrate image data cross-origin
  • BZ - 2416327 - CVE-2025-43425 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416329 - CVE-2025-43427 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416330 - CVE-2025-43429 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416331 - CVE-2025-43430 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416332 - CVE-2025-43431 webkitgtk: Processing maliciously crafted web content may lead to memory corruption
  • BZ - 2416334 - CVE-2025-43432 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416335 - CVE-2025-43434 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
  • BZ - 2416336 - CVE-2025-43440 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416337 - CVE-2025-43443 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2416355 - CVE-2025-43421 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2418576 - CVE-2025-13947 webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop
  • BZ - 2418855 - CVE-2025-43458 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2418857 - CVE-2025-66287 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0

SRPM
webkit2gtk3-2.50.3-1.el9_0.src.rpm SHA-256: 67b6ff862a16d6de98fba51d348837bb9ba1e17d48a9d42cb24c84eefc7be45d
ppc64le
webkit2gtk3-2.50.3-1.el9_0.ppc64le.rpm SHA-256: 9d5a118960900a444f5eb65041a22dcd8c43c931e2d880ad188354d6e0ed88ce
webkit2gtk3-debuginfo-2.50.3-1.el9_0.ppc64le.rpm SHA-256: 8ed658077447b2a4edd0354ee2bab9e018badb644b5e52e148a2e22f6fcde011
webkit2gtk3-debugsource-2.50.3-1.el9_0.ppc64le.rpm SHA-256: 14c0ef4fb497f310afe5fe9133d1f885289c98dc87d856ef94b8ff372e4c4a34
webkit2gtk3-devel-2.50.3-1.el9_0.ppc64le.rpm SHA-256: 409c767485474c920fd2b7d1c7e6696dff26ef1e3cca6014f9c2240f2afdad37
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_0.ppc64le.rpm SHA-256: a63511bc1af66ab772436a97c68acdadc1f1598e9da0b6862fb8389c41be8326
webkit2gtk3-jsc-2.50.3-1.el9_0.ppc64le.rpm SHA-256: 0f6c502bbd794e187cea5e4319bfd0cf8df55e69628088702ecbee384a79018e
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_0.ppc64le.rpm SHA-256: 5b9ffd72301617c1f97d57336e971157754fbd9916863ed6150adbd981dd20c6
webkit2gtk3-jsc-devel-2.50.3-1.el9_0.ppc64le.rpm SHA-256: 45182c5bde9b374e0c567948919c819267f7fabf0ce5c63b44f6674853219616
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_0.ppc64le.rpm SHA-256: aca7cbe8e1b73850422634a3e64787ae108461910a0d4f43251ae9183f3a2a8b

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0

SRPM
webkit2gtk3-2.50.3-1.el9_0.src.rpm SHA-256: 67b6ff862a16d6de98fba51d348837bb9ba1e17d48a9d42cb24c84eefc7be45d
x86_64
webkit2gtk3-2.50.3-1.el9_0.i686.rpm SHA-256: 97f40a52b1b52bd0028fd0021dacc3459d79c2ecbbbab2784bf799adadb1a60d
webkit2gtk3-2.50.3-1.el9_0.x86_64.rpm SHA-256: a65c91f41ea6e07a2827285da37d1cf8980b60cc91bdccb175ea0b607e3ae8a4
webkit2gtk3-debuginfo-2.50.3-1.el9_0.i686.rpm SHA-256: de9e3d807f11de959e76d600d9634499d0fd7367f2338d795c4dfc6938f66b4c
webkit2gtk3-debuginfo-2.50.3-1.el9_0.x86_64.rpm SHA-256: 16e0964df774e0a1b94a512c46b3049cecc3a6837afd0e23220f2bf87492602e
webkit2gtk3-debugsource-2.50.3-1.el9_0.i686.rpm SHA-256: 9c51436e06fceca94d2e37780feedb0ee07dfb3799d18bc6cbe348f8a57267b0
webkit2gtk3-debugsource-2.50.3-1.el9_0.x86_64.rpm SHA-256: d670806a8eb08969af541a699a4072bce1c19574ce075e5398fc5a455257ef53
webkit2gtk3-devel-2.50.3-1.el9_0.i686.rpm SHA-256: a73d45b449b489976bb7538452e7190c1a3684ba87f5b33aa4fce90b28116af1
webkit2gtk3-devel-2.50.3-1.el9_0.x86_64.rpm SHA-256: ff8aa4d70539e29bd92a15de9a8cf1d7f171ff5b66412786058db0433bc36d31
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_0.i686.rpm SHA-256: 1811326c064ec0a551e7e5cf486db4138c344e2266761dd18c77e6e17a358486
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_0.x86_64.rpm SHA-256: edb34a66c2d2634dd33449e9b154ef15eede72646dc25b3a497e2267ed12b38b
webkit2gtk3-jsc-2.50.3-1.el9_0.i686.rpm SHA-256: 6cb66f89150374db2a34245f1c99231287d62894c35025d8520fdd7f0338f3dc
webkit2gtk3-jsc-2.50.3-1.el9_0.x86_64.rpm SHA-256: a2b02b59379537599ac6b17f331ac8b4f11debceb6cc91d8920c8732cfffc467
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_0.i686.rpm SHA-256: 8f368fcc2921f4ab0775ff95e7024f4b8f4054904e6b0c03b780a6fff735db34
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_0.x86_64.rpm SHA-256: 04f4700533611594ac326aa0ead594ee900d1ffc99d6533ae1be8918d27c03ab
webkit2gtk3-jsc-devel-2.50.3-1.el9_0.i686.rpm SHA-256: 1c7e26525db8f34a886e55d3f868acedc56a051c9b7b9ecdd4fdee85aa307a02
webkit2gtk3-jsc-devel-2.50.3-1.el9_0.x86_64.rpm SHA-256: f6db87768fd5e8170c0848088f462752e54a77d50c2caf2eeae2c789fa459c92
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_0.i686.rpm SHA-256: c62064a8d4385d5e09156cbbc50a3a662e30b5d1adcc7a54683fe1d10cca580a
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_0.x86_64.rpm SHA-256: d6c4b1e4bfab27c4805598ab546f6aeaf8c9e363138cedd267cc6bf217f2777d

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0

SRPM
webkit2gtk3-2.50.3-1.el9_0.src.rpm SHA-256: 67b6ff862a16d6de98fba51d348837bb9ba1e17d48a9d42cb24c84eefc7be45d
aarch64
webkit2gtk3-2.50.3-1.el9_0.aarch64.rpm SHA-256: 203de271208294231054cedaf8745acde4c3e9e5527bfee3ebb4ecd6279b9a26
webkit2gtk3-debuginfo-2.50.3-1.el9_0.aarch64.rpm SHA-256: b9a418370ea347b7826a30e0cbfdcbd69c8561f6440aefe9c4bc1c68b48b02e4
webkit2gtk3-debugsource-2.50.3-1.el9_0.aarch64.rpm SHA-256: 8aec1081b07eb94b9a2c56536f14310f4dce3320c90f5b0e8af17bf60b90a502
webkit2gtk3-devel-2.50.3-1.el9_0.aarch64.rpm SHA-256: f1d5623c066612511f238a651a0b1c3fd6771500ab4c4414f89cd9961aed6ba6
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_0.aarch64.rpm SHA-256: 5a79636a2b9cc506e6a77ce4e45887cf737ef71aabe70c8474894707e759aa84
webkit2gtk3-jsc-2.50.3-1.el9_0.aarch64.rpm SHA-256: 2eaa2527c9b91c711e9802a8c93bb7b1cd7d09a659abc793e3f3014eb544848e
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_0.aarch64.rpm SHA-256: d1d6caaff8a5ba1940ab74911e1864fc11ba70759e0cb51f6c5a73fd52161b45
webkit2gtk3-jsc-devel-2.50.3-1.el9_0.aarch64.rpm SHA-256: e364652c63929b0b2a11daa358d08dbae6a21bef7cb1f7258a6f5577a8fd8ce5
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_0.aarch64.rpm SHA-256: 67e433f16bbe5d2aefbfc172beb91d3f9a665ad04a27cd79af49f932e11fa0bf

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0

SRPM
webkit2gtk3-2.50.3-1.el9_0.src.rpm SHA-256: 67b6ff862a16d6de98fba51d348837bb9ba1e17d48a9d42cb24c84eefc7be45d
s390x
webkit2gtk3-2.50.3-1.el9_0.s390x.rpm SHA-256: 58c9d85feb1b811e401db9304b0e2ebab4560eceb69aaedc6c4990e35f3f724c
webkit2gtk3-debuginfo-2.50.3-1.el9_0.s390x.rpm SHA-256: 848afc7691ae3eb210e3e02d55e65675e835bc9987b87d7f9f6d1a8e4dde36fd
webkit2gtk3-debugsource-2.50.3-1.el9_0.s390x.rpm SHA-256: a68ca67086b3cf45168dd0153c6cf111a9e1fd99ce0a4b8106fb747d4d9d2ad5
webkit2gtk3-devel-2.50.3-1.el9_0.s390x.rpm SHA-256: a50a677f900c18bf9c9e3dd5b5ca9ad0cec5a703df35e56453e170b9a484ee89
webkit2gtk3-devel-debuginfo-2.50.3-1.el9_0.s390x.rpm SHA-256: a6b4050f4a0e2346ce03ac8f8044ee3389283f64c2caac533dfae9860d341b4b
webkit2gtk3-jsc-2.50.3-1.el9_0.s390x.rpm SHA-256: b4dca4f51a8f4df19c8c9072f2e933bf8591439af2034a3b79f1b233c06fe0ac
webkit2gtk3-jsc-debuginfo-2.50.3-1.el9_0.s390x.rpm SHA-256: 07ebfabc9e5f5e7b99133d87dae4108bf5c3a6f83ddbd36f07c5c594ee9dfed7
webkit2gtk3-jsc-devel-2.50.3-1.el9_0.s390x.rpm SHA-256: d2b936ed5a8f64fdc5c6dab2b339ef045298fd2dc2310c634a1f7083c9cb8909
webkit2gtk3-jsc-devel-debuginfo-2.50.3-1.el9_0.s390x.rpm SHA-256: 351f253b0266f2bbb0ef12b5a005742b7d902ffef05fc70809bd3af70c46fc0b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.