[SECURITY] [DSA 5899-1] webkit2gtk security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5899-1 security@debian.org
https://www.debian.org/security/ Alberto Garcia
April 10, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : webkit2gtk
CVE ID : CVE-2024-54551 CVE-2025-24208 CVE-2025-24209 CVE-2025-24213
CVE-2025-24216 CVE-2025-24264 CVE-2025-30427
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
CVE-2024-54551
ajajfxhj discovered that processing web content may lead to a
denial-of-service.
CVE-2025-24208
Muhammad Zaid Ghifari and Kalimantan Utara discovered that loading
a malicious iframe may lead to a cross-site scripting attack.
CVE-2025-24209
Francisco Alonso and an anonymous researcher discovered that
processing maliciously crafted web content may lead to an
unexpected process crash.
CVE-2025-24213
The Google V8 Security Team discovered that a type confusion issue
could lead to memory corruption. Note that this CVE is fixed only
on ARM architectures. x86_64 is not vulnerable, x86 is not
vulnerable when the SSE2 instruction set is enabled; but other
architectures remain vulnerable.
CVE-2025-24216
Paul Bakker discovered that processing maliciously crafted web
content may lead to an unexpected Safari crash.
CVE-2025-24264
Gary Kwong and an anonymous researcher discovered that processing
maliciously crafted web content may lead to an unexpected crash.
CVE-2025-30427
rheza discovered that processing maliciously crafted web content
may lead to an unexpected crash.
For the stable distribution (bookworm), these problems have been fixed in
version 2.48.1-2~deb12u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmf4PZkACgkQAAyEYu0C
2AIO6g/+InbL4sTvYyyhWrplfR6Fj2Bqsdq26L/Yb9DfeHRtCEWGTX2hwCp1da0U
4s3BgjTiCtdZrWGrcaCayvg0KC1OB/mnvj+KIZ4XMFsplO6E488DGDtAxZnDZ5JB
Wv+x0pXb3Oc6QjXwWDSjD70lfwoLpWRefzP846n/XzCqA/VlnfLsNqt4Gia0uu79
JDMF3rlnHUVG5NB1Dk6oziW3uWeOQmTSSmAp/mtzbGddM4fpE3q6yig41TK0DXEQ
/7NUipv5oPCl6bsG2PSAuSffGlrT909TwLfwCLQ2IcCjY8b9+omgOZK5sSxRgP2P
uaD4h9RIPMmpJo5eF/CxO9b345XQlqv2xR0xSVdxyHXtJWjZx9oxCqp0a0aHgYO7
GQQSwopXli5fwBZdIyZ2et4e/sCB7PaZI9GvzOjfarrvl3EJ2AavBkXyOrw/k1WZ
BNeATDLYDejqt5tZzAvxFf3N/1BJhvpkjowkfavM2xNk+dPVoNkGoNTmQXQZzIsE
eRwl4l64rNy04OAgeJg+P2e7tggtMvYxbmlbVZVQBpoJcBh4qCp7MCG4Vf6U18uc
smR0rXs5vX9Vgloe9AnqfH/8KslYzTIYt3X9VsdKSqWB3tpi54uFFLTaQNasuo/b
s0QGEFcthNgPjEguhm3Dic0P/TqNaU/uskAiSljOequirDhbPZU=
=fQdP
-----END PGP SIGNATURE-----
Reply to: