Red Hat Product Errata RHSA-2025:23969 - Security Advisory
Issued:
2025-12-24
Updated:
2025-12-24

RHSA-2025:23969 - Security Advisory

Synopsis

Important: webkit2gtk3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • webkitgtk: webkitgtk: Use-after-free due to improper memory management (CVE-2025-43529)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43501)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43531)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43535)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43536)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 8.2 x86_64

Fixes

  • BZ - 2423166 - CVE-2025-43529 webkitgtk: webkitgtk: Use-after-free due to improper memory management
  • BZ - 2423185 - CVE-2025-43501 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423187 - CVE-2025-43531 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423188 - CVE-2025-43535 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423190 - CVE-2025-43536 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423191 - CVE-2025-43541 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Red Hat Enterprise Linux Server - AUS 8.2

SRPM
webkit2gtk3-2.50.4-1.el8_2.src.rpm SHA-256: 33a5807b2146d5621088f3cfb427321dcc2df376d9b689cb345e660543a263bd
x86_64
webkit2gtk3-2.50.4-1.el8_2.i686.rpm SHA-256: ed66d66db5761d52e9123cde3ff83dc4682441dbe5dd128386eb5ef0928dcb75
webkit2gtk3-2.50.4-1.el8_2.x86_64.rpm SHA-256: 91e592c39453b315cf1b988ac818685074bc23b9b4c0dc441a99007fe8f8c076
webkit2gtk3-debuginfo-2.50.4-1.el8_2.i686.rpm SHA-256: 584c29a2567bea125297f96fc524758f6fee9564b3a83d2b4badd08248e80b09
webkit2gtk3-debuginfo-2.50.4-1.el8_2.x86_64.rpm SHA-256: d59b65252b8539dca0ca6f1ce8a83496cededd3b60381b96f4b6bf5c46eb2108
webkit2gtk3-debugsource-2.50.4-1.el8_2.i686.rpm SHA-256: fa587c4f31bdda248a3e9b147f13662f7f819c8f5a6804ae41af8f63244597e2
webkit2gtk3-debugsource-2.50.4-1.el8_2.x86_64.rpm SHA-256: 0bbd4b4738091f15cdd45e3e5670c1e650f13e3c66498708e2ab6342caa426a3
webkit2gtk3-devel-2.50.4-1.el8_2.i686.rpm SHA-256: dcf07b2382e17c15a9b100230cd140ceae973cc4189be7832ce05c8f6cbf75a4
webkit2gtk3-devel-2.50.4-1.el8_2.x86_64.rpm SHA-256: 1a6fecf0a2a1c51632913bd5189cae275a815549d2c1236087fb1a4452619bc0
webkit2gtk3-devel-debuginfo-2.50.4-1.el8_2.i686.rpm SHA-256: 777b374d4f529821b9f105c47bdc01bb6895226a355832466f83c0d3e7926f6d
webkit2gtk3-devel-debuginfo-2.50.4-1.el8_2.x86_64.rpm SHA-256: 7b255412a7fc601717d900c9996a7a0b18cf8b947cb97f4780bfb2032db877bb
webkit2gtk3-jsc-2.50.4-1.el8_2.i686.rpm SHA-256: 04d5ddaa32d2446300fc334d10432cdd570ce2ef81d9e782ac83e612aafc8190
webkit2gtk3-jsc-2.50.4-1.el8_2.x86_64.rpm SHA-256: bf4d3c413b6358b3500d20826c9dcd6c64f8b803d48321c4d1d1dfc96b44604b
webkit2gtk3-jsc-debuginfo-2.50.4-1.el8_2.i686.rpm SHA-256: 93df5385726cc1603f73e7097124400943a8e479fe0594aebfe2ec54099f304b
webkit2gtk3-jsc-debuginfo-2.50.4-1.el8_2.x86_64.rpm SHA-256: 12105b11099c852db58b28e4215975437421bd2121f63fea4d5572c969f0cc15
webkit2gtk3-jsc-devel-2.50.4-1.el8_2.i686.rpm SHA-256: a4d29d2d729f97ef28a8bef8fd0eef68203ce02e40f247ac545f5299882d9b07
webkit2gtk3-jsc-devel-2.50.4-1.el8_2.x86_64.rpm SHA-256: c08cfdf1b1085181a50143c3d480462eb62c89a5f95caea86ea53607d1056f6d
webkit2gtk3-jsc-devel-debuginfo-2.50.4-1.el8_2.i686.rpm SHA-256: b30e8b27dac9bb1485fe34e40a923989fa2e855537869eb0ef448f1985d60849
webkit2gtk3-jsc-devel-debuginfo-2.50.4-1.el8_2.x86_64.rpm SHA-256: d3c76cb57484f29ce7fb7d21547acd509bb6d805505a28b86ab0a03f4581d6ee

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.