RHSA-2025:23583 — Security Advisory

Red Hat Security Advisory: webkitgtk4 security update

Loading…

Severity

Important

Red Hat Product Security

RHEL 7

Products

Official CSAF product identity

Published · December 18, 2025

Updated · October 16, 2026

Topic

An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.

Security Fix(es):

webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.