Alerts This Week
Warning Icon 1 540
Alerts This Week
Warning Icon 1 540

openSUSE Leap 15.4: 2025:1336-1 important: webkit2gtk3 vulnerabilities

opensuse
Calendar Grey April 17, 2025
Dist Opensuse Esm H88
This major security patch for webkit2gtk3 resolves significant vulnerabilities such as denial-of-service scenarios and buffer overflow risks.
An update that solves seven vulnerabilities can now be installed.

Description

This update for webkit2gtk3 fixes the following issues:

* Update to version 2.48.1

* CVE-2024-54551: improper memory handling may lead to a denial-of-service

when processing certain web content (bsc#1240962)

* CVE-2025-24208: permissions issue may lead to a cross-site scripting attack

when loading a malicious iframe (bsc#1240961)

* CVE-2025-24209: buffer overflow may lead to crash when processing

maliciously crafted web content (bsc#1240964)

* CVE-2025-24213: type confusion issue may lead to memory corruption

(bsc#1240963)

* CVE-2025-24216: improper memory handling may lead to an unexpected crash

when processing certain web content (bsc#1240986)

* CVE-2025-24264: improper memory handling may lead to unexpected crash when

processing certain web content (bsc#1240987)

* CVE-2025-30427: use-after-free issue may lead to an unexpected Safari crash

when processing maliciously crafted web content (bsc#1240958)

Topics%20covered

Topics Covered

security advisory buffer overflow important SUSE denial-of-service webkit2gtk3

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch SUSE-2025-1336=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-1336=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-1336=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-1336=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-1336=1

* SUSE Linux Enterprise Server 15 SP4 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-1336=1

* SUSE Linux Enterprise Server 15 SP5 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-1336=1

* SUSE Linux Enterprise...

Read the Full Advisory

Package List

* openSUSE Leap 15.4 (noarch)

* WebKitGTK-4.0-lang-2.48.1-150400.4.115.2

* WebKitGTK-4.1-lang-2.48.1-150400.4.115.2

* WebKitGTK-6.0-lang-2.48.1-150400.4.115.2

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)

* typelib-1_0-WebKitWebProcessExtension-6_0-2.48.1-150400.4.115.2

* libjavascriptcoregtk-4_0-18-2.48.1-150400.4.115.2

* webkit-jsc-4-debuginfo-2.48.1-150400.4.115.2

* webkit2gtk-4_1-injected-bundles-debuginfo-2.48.1-150400.4.115.2

* webkit-jsc-4-2.48.1-150400.4.115.2

* libwebkit2gtk-4_1-0-debuginfo-2.48.1-150400.4.115.2

* webkitgtk-6_0-injected-bundles-debuginfo-2.48.1-150400.4.115.2

* webkit2gtk3-soup2-minibrowser-debuginfo-2.48.1-150400.4.115.2

* webkit2gtk4-devel-2.48.1-150400.4.115.2

* typelib-1_0-WebKit2WebExtension-4_1-2.48.1-150400.4.115.2

* webkit-jsc-4.1-2.48.1-150400.4.115.2

* webkit2gtk3-debugsource-2.48.1-150400.4.115.2

* typelib-1_0-JavaScriptCore-4_0-2.48.1-150400.4.115.2

* libjavascriptcoregtk-4_0-18-debuginfo-2.48.1-150400.4.115.2

*...

Read the Full Advisory

References

* bsc#1240958

* bsc#1240961

* bsc#1240962

* bsc#1240963

* bsc#1240964

* bsc#1240986

* bsc#1240987

## References:

* https://www.suse.com/security/cve/CVE-2024-54551.html

* https://www.suse.com/security/cve/CVE-2025-24208.html

* https://www.suse.com/security/cve/CVE-2025-24209.html

* https://www.suse.com/security/cve/CVE-2025-24213.html

* https://www.suse.com/security/cve/CVE-2025-24216.html

* https://www.suse.com/security/cve/CVE-2025-24264.html

* https://www.suse.com/security/cve/CVE-2025-30427.html

* https://bugzilla.suse.com/show_bug.cgi?id=1240958

* https://bugzilla.suse.com/show_bug.cgi?id=1240961

* https://bugzilla.suse.com/show_bug.cgi?id=1240962

* https://bugzilla.suse.com/show_bug.cgi?id=1240963

* https://bugzilla.suse.com/show_bug.cgi?id=1240964

* https://bugzilla.suse.com/show_bug.cgi?id=1240986

* https://bugzilla.suse.com/show_bug.cgi?id=1240987

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:1336-1
Release Date: 2025-04-17T11:01:57Z
Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3

Topics%20covered

Topics Covered

security advisory buffer overflow important SUSE denial-of-service webkit2gtk3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here