SUSE-SU-2026:4858-1

SUSE-SU-2026:4858-1 · Security update for webkit2gtk3

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619): - CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution. - CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege. - CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution. - CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege. - CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. - CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. - CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. - CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege. - CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege. - CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure. - CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation. - CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. - CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-10019: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-10881: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10883: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-10889: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10907: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-10919: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10941: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-10974: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10977: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-10979: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-10985: Out of bounds read in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-10993: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-10994: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11004: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11024: Stack buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. - CVE-2026-11039: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-11040: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11051: Out of bounds read in ANGLE in Google Chrome on Linux allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11057: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11061: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11065: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11066: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11087: Uninitialized Use i

Correctif disponible

Publication

2026-10-22T09:58:04Z

Mise à jour

2026-10-22T18:00:58.595080127Z

Pile logicielle: system

Vérifiez votre serveur →