[SECURITY] [DLA 4394-1] webkit2gtk security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4394-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
December 04, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : webkit2gtk
Version : 2.50.2-1~deb11u1
CVE ID : CVE-2025-43392 CVE-2025-43425 CVE-2025-43427 CVE-2025-43429
CVE-2025-43430 CVE-2025-43431 CVE-2025-43432 CVE-2025-43434
CVE-2025-43440 CVE-2025-43443
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
CVE-2025-43392
Tom Van Goethem discovered that a website may exfiltrate image
data cross-origin.
CVE-2025-43425
An anonymous researcher discovered that processing maliciously
crafted web content may lead to an unexpected process crash.
CVE-2025-43427
Gary Kwong and rheza discovered that processing maliciously
crafted web content may lead to an unexpected process crash.
CVE-2025-43429
Google Big Sleep discovered that processing maliciously crafted
web content may lead to an unexpected process crash.
CVE-2025-43430
Google Big Sleep discovered that processing maliciously crafted
web content may lead to an unexpected process crash.
CVE-2025-43431
Google Big Sleep discovered that processing maliciously crafted
web content may lead to memory corruption.
CVE-2025-43432
Hossein Lotfi discovered that processing maliciously crafted web
content may lead to an unexpected process crash.
CVE-2025-43434
Google Big Sleep discovered that processing maliciously crafted
web content may lead to an unexpected browser crash.
CVE-2025-43440
Nan Wang discovered that processing maliciously crafted web
content may lead to an unexpected process crash.
CVE-2025-43443
An anonymous researcher discovered that processing maliciously
crafted web content may lead to an unexpected process crash.
For Debian 11 bullseye, these problems have been fixed in version
2.50.2-1~deb11u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmkxNSAACgkQnUbEiOQ2
gwJg+BAArfeMbOeFiO5udJvilEpB6QWdHvPt4exU7RRnD9EZa8ApW1VMbIl5tG6M
SEqEZS4tWXlWr6JWszYCC+TCpvlqS6QljPqYf3UDG1WntgpRzg1ATV5FdzW1Se+z
3fHPrcsk8YarOhypERC0VoOkP6e5wobEL6Bn0bh8ojTRupGgY7RHe+FWn1POYcGo
TBc9COtm41vnsoUt0KZ+2l6QyzS/OOh5fh0+qqn7XERM0MwtjzphiDxgZIDgCrKH
48iQyMPVbih7z0sWYYTdqBZfQWAluJ8ktlW+NQm/50bVkJwl0vwrv1qSmx6t+CYZ
ZsMDiA+WCSBTBOBI6W4qB0aFEARqHtc/LGU0kf3wgpfrHhYjxxxaAW06j6nj+PWp
VnwlgFbIwRt+9m8N54rE/9MT0/YlbMk7tIp5oUzUx7kVR2bH3GgCj2KlEZgt8mkW
VWpoJjbbwiVj4mI+rjjIQVHCtyJdkZExm1iB4/PnhJ5HmslH6CRuBtkXQ5Q9mX5L
2+CYu4UQcRred2GnG3nSg7Evk/NPwJdfkV/QRyshwibCG0vzs7VdjOrifilJVjxX
4vnnJ0vySsSqI7N1MAUicjg3SntnieTaJJT8KLMURl8u2HFHv/LGADHdjvV6RDnl
iy/Gj3huiuJJ5d8+bpzFfmVp46d/ggnh22DRNBSogb2YXzhqRvM=
=erYA
-----END PGP SIGNATURE-----
Reply to: