p PatchFirst

SUSE-SU-2026:3338-1

SUSE-SU-2026:3338-1 · Security update for webkit2gtk3

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for webkit2gtk3 fixes the following issues: - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution (bsc#1271638). - CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43663: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43676: out-of-bounds access when processing web content can lead to an unexpected Safari crash (bsc#1271638). - CVE-2026-43699: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43701: malicious website can process restricted web content outside the sandbox (bsc#1271638). - CVE-2026-43705: type confusion issue when processing web content can lead to memory corruption (bsc#1271638). - CVE-2026-43707: memory corruption issue when processing web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43712: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43713: visiting a website can leak sensitive data due to a permissions issue (bsc#1271638). - CVE-2026-43715: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638). - CVE-2026-43716: maliciously crafted web content can lead to an unexpected Safari crash (bsc#1271638). - CVE-2026-43720: use-after-free issue when processing web content can lead to an unexpected Safari crash (bsc#1271638). - CVE-2026-43721: malicious website can silently hijack clipboard data (bsc#1271638). - CVE-2026-43725: unvalidated input can allow a malicious website to process restricted web content outside the sandbox (bsc#1271638). - CVE-2026-43726: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43727: use-after-free issue when processing web content can lead to an unexpected Safari crash (bsc#1271638). - CVE-2026-43731: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638). - CVE-2026-43732: path handling issue when processing web content can disclose sensitive user information (bsc#1271638). - CVE-2026-43734: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43740: maliciously crafted web content can result in the disclosure of process memory (bsc#1271638). - CVE-2026-43742: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638). - CVE-2026-43745: out-of-bounds write issue when processing web content can lead to an unexpected Safari crash (bsc#1271638). Changes for webkit2gtk3: - Update to version 2.52.5: * Fire scrollend event for instant programmatic scrolls. * Increase network idle connection timeout to 115 seconds. * Add User-Agent quirk for HBO Max. * Fix the build with system malloc.

Fix available

Published
Updated

Stack: system

Affected products and versions

  • webkit2gtk3-soup2 SUSE:Linux Enterprise Module for Basesystem 15 SP7

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk4 SUSE:Linux Enterprise Module for Basesystem 15 SP7

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk3 SUSE:Linux Enterprise Module for Desktop Applications 15 SP7

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk4 SUSE:Linux Enterprise Module for Development Tools 15 SP7

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk3 SUSE:Linux Enterprise Server 15 SP6-LTSS

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk3-soup2 SUSE:Linux Enterprise Server 15 SP6-LTSS

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk4 SUSE:Linux Enterprise Server 15 SP6-LTSS

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk3 SUSE:Linux Enterprise Server for SAP Applications 15 SP6

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk3-soup2 SUSE:Linux Enterprise Server for SAP Applications 15 SP6

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

  • webkit2gtk4 SUSE:Linux Enterprise Server for SAP Applications 15 SP6

    Affected ranges
    • ECOSYSTEM: < 2.52.5-150600.12.71.1

    Update to 2.52.5-150600.12.71.1

Original sources

Check your server →