Debian Wpewebkit vulnerabilities

CVE-2020-11793 [HIGH] CVE-2020-11793: webkit2gtk - A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2... A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash). Scope: local bookworm: resolved (fixed in 2.28.1-1) bullseye: resolved (fixed in 2.28.1-1) forky: resolved (fixed in 2.28.1-1) s

CVE-2020-27918 [HIGH] CVE-2020-27918: webkit2gtk - A use after free issue was addressed with improved memory management. This issue... A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution. Scope: local bookworm: resolved (fixed in 2.30.6-1) b

CVE-2021-30848 [HIGH] CVE-2021-30848: webkit2gtk - A memory corruption issue was addressed with improved memory handling. This issu... A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution. Scope: local bookworm: resolved (fixed in 2.32.4-1) bullseye: resolved (fixed in 2.32.4-1~deb11u1) forky: resolved (fixed in 2.32.4-1) sid: r

CVE-2024-54479 [HIGH] CVE-2024-54479: webkit2gtk - The issue was addressed with improved checks. This issue is fixed in Safari 18.2... The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash. Scope: local bookworm: resolved (fixed in 2.46.5-1~deb12u1) bullseye: resolved (fixed in 2.46.5-1~d

CVE-2025-24223 [HIGH] CVE-2025-24223: webkit2gtk - The issue was addressed with improved memory handling. This issue is fixed in Sa... The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption. Scope: local bookworm: resolved (fixed in 2.48.3-1~deb12u1) bullseye: resolved (fixed in 2.48.3-1~deb11u1) forky: r

CVE-2024-27856 [HIGH] CVE-2024-27856: webkit2gtk - The issue was addressed with improved checks. This issue is fixed in Safari 17.5... The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution. Scope: local bookworm: resolved (fixed in 2.46.0-2~deb12u1) bullseye: resolved (fix

CVE-2024-54502 [MEDIUM] CVE-2024-54502: webkit2gtk - The issue was addressed with improved checks. This issue is fixed in Safari 18.2... The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash. Scope: local bookworm: resolved (fixed in 2.46.5-1~deb12u1) bullseye: resolved (fixed in 2.46.5-1

CVE-2022-30293 [HIGH] CVE-2022-30293: webkit2gtk - In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overf... In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp. Scope: local bookworm: resolved (fixed in 2.36.1-1) bullseye: resolved (fixed in 2.36.3-1~deb11u1) forky: resolved (fixed in 2.36.1-1) sid: resolved (fixed in 2.36.1-1) tri

CVE-2023-38572 [HIGH] CVE-2023-38572: webkit2gtk - The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 ... The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. A website may be able to bypass Same Origin Policy. Scope: local bookworm: resolved (fixed in 2.40.5-1~deb12u1) bullseye: resolved (fixed in 2.40.5-1~deb11u1) forky: resolved (fixed i

CVE-2025-13502 [HIGH] CVE-2025-13502: webkit2gtk - A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-o... A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server. Scope: local bookworm: resolved (fixed in 2.50.2-1~deb12u1) bullseye: resolved (fixed in 2.50.2-1~deb11u1) forky: resolved (fixed in 2.50.2-1) sid: resolv

CVE-2022-22637 [HIGH] CVE-2022-22637: webkit2gtk - A logic issue was addressed with improved state management. This issue is fixed ... A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected cross-origin behavior. Scope: local bookworm: resolved (fixed in 2.34.4-1) bullseye: resolved (fixed in 2.34.4-1~deb11u1) forky: resolved (fixed in 2.34.4-1)

CVE-2020-9862 [HIGH] CVE-2020-9862: webkit2gtk - A command injection issue existed in Web Inspector. This issue was addressed wit... A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection. Scope: local bookworm: resolved

CVE-2025-43480 [HIGH] CVE-2025-43480: webkit2gtk - The issue was addressed with improved checks. This issue is fixed in Safari 26.1... The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin. Scope: local bookworm: resolved (fixed in 2.46.0-2~deb12u1) bullseye: resolved (fixed in 2.46.0-1) forky: resolved (fixed in 2.46.0-1) sid: resol

CVE-2024-54508 [HIGH] CVE-2024-54508: webkit2gtk - The issue was addressed with improved memory handling. This issue is fixed in Sa... The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash. Scope: local bookworm: resolved (fixed in 2.46.5-1~deb12u1) bullseye: resolved (fixed in 2

CVE-2026-20652 [HIGH] CVE-2026-20652: webkit2gtk - The issue was addressed with improved memory handling. This issue is fixed in Sa... The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to cause a denial-of-service. Scope: local bookworm: resolved (fixed in 2.50.6-1~deb12u1) bullseye: open forky: resolved (fixed in 2.50.6-1) sid: resolved

CVE-2021-21775 [HIGH] CVE-2021-21775: webkit2gtk - A use-after-free vulnerability exists in the way certain events are processed fo... A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage. Scope: local bookworm: resolved (fi

CVE-2025-24213 [HIGH] CVE-2025-24213: webkit2gtk - This issue was addressed with improved handling of floats. This issue is fixed i... This issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A type confusion issue could lead to memory corruption. Scope: local bookworm: resolved (fixed in 2.48.1-2~deb12u1) bullseye: resolved (fixed in 2.48.3-1~deb11u1) forky:

CVE-2020-3864 [HIGH] CVE-2020-3864: webkit2gtk - A logic issue was addressed with improved validation. This issue is fixed in iCl... A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin. Scope: local bookworm: resolved (fixed in 2.26.4-1) bullseye: resolved (fixed in 2.26.4-

CVE-2025-43541 [MEDIUM] CVE-2025-43541: webkit2gtk - A type confusion issue was addressed with improved state handling. This issue is... A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. Scope: local bookworm: resolved (fixed in 2.50.4-1~deb12u1) bullseye: resolved (fixed in

CVE-2025-13947 [HIGH] CVE-2025-13947: webkit2gtk - A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted i... A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser. Scope: local bookworm: resolved (fixed in 2.50.3-1~deb12u1) bullseye: reso