红帽产品勘误 RHSA-2025:23975 - Security Advisory
发布：
2025-12-24
已更新：
2025-12-24

RHSA-2025:23975 - Security Advisory

概述

Important: webkitgtk4 security update

类型/严重性

Security Advisory: Important

Red Hat Lightspeed patch analysis

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.

Security Fix(es):

  • webkitgtk: webkitgtk: Use-after-free due to improper memory management (CVE-2025-43529)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43501)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43531)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43535)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43536)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

修复

  • BZ - 2423166 - CVE-2025-43529 webkitgtk: webkitgtk: Use-after-free due to improper memory management
  • BZ - 2423185 - CVE-2025-43501 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423187 - CVE-2025-43531 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423188 - CVE-2025-43535 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423190 - CVE-2025-43536 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
  • BZ - 2423191 - CVE-2025-43541 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
webkitgtk4-2.50.4-2.el7_9.src.rpm SHA-256: eff3cc4c26e03413336e67d2bab310ad4c52f17dd8ba8c71a2ff3eecdc3f2cb7
x86_64
webkitgtk4-2.50.4-2.el7_9.x86_64.rpm SHA-256: 9d7f574b62c8ad0797d8c62001f3bc672d7e13e8904e3258501e5ddb3f3244aa
webkitgtk4-debuginfo-2.50.4-2.el7_9.x86_64.rpm SHA-256: 837e9310723805e16828793a8b91011cb730e4dae3ff268c39e2665ec1d0db94
webkitgtk4-devel-2.50.4-2.el7_9.x86_64.rpm SHA-256: 83233617f87e52680511a28120a0888c9c6e8696ec9e69cdc981561e925edb1b
webkitgtk4-doc-2.50.4-2.el7_9.noarch.rpm SHA-256: 6dc0999b08b714b34b6dab0853c159e0b528d43d8c66be43fbb3e4a8fa8cb607
webkitgtk4-jsc-2.50.4-2.el7_9.x86_64.rpm SHA-256: 59a402246c5c3fe4d16c167d411f9ddb3a4b2c1c51d0acdcf8886e888870889b
webkitgtk4-jsc-devel-2.50.4-2.el7_9.x86_64.rpm SHA-256: c9307e128639b78495bfda5d28d859267c4606161b1bed18fe5fa83ec4140f12

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
webkitgtk4-2.50.4-2.el7_9.src.rpm SHA-256: eff3cc4c26e03413336e67d2bab310ad4c52f17dd8ba8c71a2ff3eecdc3f2cb7
s390x
webkitgtk4-2.50.4-2.el7_9.s390x.rpm SHA-256: 901c76eaef4af03322d79dae350e9a4ab61f3c9d09d201de69c7fb972af567c9
webkitgtk4-debuginfo-2.50.4-2.el7_9.s390x.rpm SHA-256: ccc5b44dde5bdce735fa9e43f3b48758c9768bb2f4b431f980c7adbb9e2a97e0
webkitgtk4-debuginfo-2.50.4-2.el7_9.s390x.rpm SHA-256: ccc5b44dde5bdce735fa9e43f3b48758c9768bb2f4b431f980c7adbb9e2a97e0
webkitgtk4-devel-2.50.4-2.el7_9.s390x.rpm SHA-256: 76a8d3ce42b8369624a2f6ab9b38873317a78976ed32ca0693a8719ba2cee2ba
webkitgtk4-doc-2.50.4-2.el7_9.noarch.rpm SHA-256: 6dc0999b08b714b34b6dab0853c159e0b528d43d8c66be43fbb3e4a8fa8cb607
webkitgtk4-jsc-2.50.4-2.el7_9.s390x.rpm SHA-256: 727dc95a6d89331110f123957a93ab5f6837fbc381e06d70a59e05ba0b75bc82
webkitgtk4-jsc-devel-2.50.4-2.el7_9.s390x.rpm SHA-256: ff272d7e73eb249bcf2aec5ce771b7be7e41358e363f1bab29e16a6e13cff064

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
webkitgtk4-2.50.4-2.el7_9.src.rpm SHA-256: eff3cc4c26e03413336e67d2bab310ad4c52f17dd8ba8c71a2ff3eecdc3f2cb7
ppc64
webkitgtk4-doc-2.50.4-2.el7_9.noarch.rpm SHA-256: 6dc0999b08b714b34b6dab0853c159e0b528d43d8c66be43fbb3e4a8fa8cb607

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
webkitgtk4-2.50.4-2.el7_9.src.rpm SHA-256: eff3cc4c26e03413336e67d2bab310ad4c52f17dd8ba8c71a2ff3eecdc3f2cb7
ppc64le
webkitgtk4-2.50.4-2.el7_9.ppc64le.rpm SHA-256: 4c2e9867e34db51378e0aa3bfbe875f995dd2c72e1b0e5b67f8f3b01d25107a2
webkitgtk4-debuginfo-2.50.4-2.el7_9.ppc64le.rpm SHA-256: 966b6cc98e0baff827f1cf9f9b03e8744e3720d07df0eb53782e33fb84f2d4ef
webkitgtk4-devel-2.50.4-2.el7_9.ppc64le.rpm SHA-256: b8d9d37f0e99711eb7ac84eb366fd4ee7ee8eac12557ff11910973a3f6fb6568
webkitgtk4-doc-2.50.4-2.el7_9.noarch.rpm SHA-256: 6dc0999b08b714b34b6dab0853c159e0b528d43d8c66be43fbb3e4a8fa8cb607
webkitgtk4-jsc-2.50.4-2.el7_9.ppc64le.rpm SHA-256: d509a6434d33c0e49a49e2cb1a7ef78adeb93ffa37b9159fa330d67da3648892
webkitgtk4-jsc-devel-2.50.4-2.el7_9.ppc64le.rpm SHA-256: 7bb2078fe1271b36861e106033a72af9b4072abc3cbc76e2cd8bb5bd8f77f506

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。