Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 68 articles for you...
202
security advisoryDoSimportantopenSUSE webkit2gtk3 Important Update Security Advisory 2026-21129-1
An update that solves 16 vulnerabilities and has 16 bug fixes can now be installed.. openSUSE security update: security update for webkit2gtk3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21129-1 Rating: important References: * bsc#1267506 * bsc#1267507 * bsc#1267508 * bsc#1267509 * bsc#1267510 * bsc#1267511 * bsc#1267512 * bsc#1267513 * bsc#1267514 * bsc#1267515 * bsc#1267516 * bsc#1267517 * bsc#1267518 * bsc#1267519 * bsc#1267520 * bsc#1267521 Cross-References: * CVE-2026-28847 * CVE-2026-28883 * CVE-2026-28901 * CVE-2026-28902 * CVE-2026-28903 * CVE-2026-28904 * CVE-2026-28905 * CVE-2026-28907 * CVE-2026-28942 * CVE-2026-28946 * CVE-2026-28947 * CVE-2026-28953 * CVE-2026-28955 * CVE-2026-28958 * CVE-2026-43658 * CVE-2026-43660 CVSS scores: * CVE-2026-28847 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28847 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28883 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28883 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28901 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28901 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28902 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28902 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28903 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28904 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28905 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28905 ( SUSE ): 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-28942 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28942 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28946 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28946 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28947 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28947 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28953 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28955 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28955 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-28958 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-43658 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-43658 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 16 vulnerabilities and has 16 bug fixes can now be installed. Description: This update for webkit2gtk3 fixes the following issues Update to version 2.52.4: - CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrarycode execution due to a heap buffer overflow (bsc#1267506). - CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after- free issue (bsc#1267507). - CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267508). - CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267509). - CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267510). - CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267511). - CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267512). - CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to improper input validation (bsc#1267513). - CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free (bsc#1267514). - CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267515). - CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267516). - CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267517). - CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267518). - CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519). - CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due toimproper memory handling (bsc#1267520). - CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to issues with logic (bsc#1267521). Changes for webkit2gtk3: + Add support for half-width fonts. + Improve content filter compilation by avoiding file copies. + Improve handling of out of disk space conditions when the NetworkProcess tried to write data in caches. + Improve how the CMake build system checks whether libatomic is required. + Fix painting scrollbars when their width changes. + Fix playback of certain YouTube videos with low frame rates. + Fix webkit://gpu not working in systems where neither libGL.so.1 nor libOpenGL.so.0 are available. + Fix the build with librice 0.4 or newer when the GStreamer WebRTC backend is enabled at build configuration time. + Fix the build with USE_GSTREAMER_WEBRTC=OFF. + Fix the build with USE_GBM=OFF. + Fix several crashes and rendering issues. + Security fixes: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, CVe-2026-43660. + Changes in version .52.3; + Add support for the "scrollbar-color" CSS property. + Fix some emoji glyphs being rendered as missing glyph boxes. + Fix JavaScriptCore crashes on architectures other than x86_64. + Fix the build on s390x. + Changes in version 2.52.2: + Improve handling of real-time threads. + Fix scrollbar rendering glitches visible in some GPU configurations. + Fix V4L2 hardware accelerated media codecs now working due to overly restrictive sandbox device access rules. + Fix leak of bitmap images in webkit_favicon_database_get_favicon_finish(). + Fix the build with USE_GTK4=OFF. Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-994=1 Package List: - openSUSE Leap 16.0: WebKitGTK-4.0-lang-2.52.4-160000.1.1 WebKitGTK-4.1-lang-2.52.4-160000.1.1 WebKitGTK-6.0-lang-2.52.4-160000.1.1 libjavascriptcoregtk-4_0-18-2.52.4-160000.1.1 libjavascriptcoregtk-4_1-0-2.52.4-160000.1.1 libjavascriptcoregtk-6_0-1-2.52.4-160000.1.1 libwebkit2gtk-4_0-37-2.52.4-160000.1.1 libwebkit2gtk-4_1-0-2.52.4-160000.1.1 libwebkitgtk-6_0-4-2.52.4-160000.1.1 typelib-1_0-JavaScriptCore-4_0-2.52.4-160000.1.1 typelib-1_0-JavaScriptCore-4_1-2.52.4-160000.1.1 typelib-1_0-JavaScriptCore-6_0-2.52.4-160000.1.1 typelib-1_0-WebKit-6_0-2.52.4-160000.1.1 typelib-1_0-WebKit2-4_0-2.52.4-160000.1.1 typelib-1_0-WebKit2-4_1-2.52.4-160000.1.1 typelib-1_0-WebKit2WebExtension-4_0-2.52.4-160000.1.1 typelib-1_0-WebKit2WebExtension-4_1-2.52.4-160000.1.1 typelib-1_0-WebKitWebProcessExtension-6_0-2.52.4-160000.1.1 webkit-jsc-4-2.52.4-160000.1.1 webkit-jsc-4.1-2.52.4-160000.1.1 webkit-jsc-6.0-2.52.4-160000.1.1 webkit2gtk-4_0-injected-bundles-2.52.4-160000.1.1 webkit2gtk-4_1-injected-bundles-2.52.4-160000.1.1 webkit2gtk3-devel-2.52.4-160000.1.1 webkit2gtk3-minibrowser-2.52.4-160000.1.1 webkit2gtk3-soup2-devel-2.52.4-160000.1.1 webkit2gtk3-soup2-minibrowser-2.52.4-160000.1.1 webkit2gtk4-devel-2.52.4-160000.1.1 webkit2gtk4-minibrowser-2.52.4-160000.1.1 webkitgtk-6_0-injected-bundles-2.52.4-160000.1.1 References: * https://www.suse.com/security/cve/CVE-2026-28847.html * https://www.suse.com/security/cve/CVE-2026-28883.html * https://www.suse.com/security/cve/CVE-2026-28901.html * https://www.suse.com/security/cve/CVE-2026-28902.html * https://www.suse.com/security/cve/CVE-2026-28903.html * https://www.suse.com/security/cve/CVE-2026-28904.html * https://www.suse.com/security/cve/CVE-2026-28905.html * https://www.suse.com/security/cve/CVE-2026-28907.html *https://www.suse.com/security/cve/CVE-2026-28942.html * https://www.suse.com/security/cve/CVE-2026-28946.html * https://www.suse.com/security/cve/CVE-2026-28947.html * https://www.suse.com/security/cve/CVE-2026-28953.html * https://www.suse.com/security/cve/CVE-2026-28955.html * https://www.suse.com/security/cve/CVE-2026-28958.html * https://www.suse.com/security/cve/CVE-2026-43658.html * https://www.suse.com/security/cve/CVE-2026-43660.html . Critical openSUSE update resolving 16 issues in webkit2gtk3; essential fixes for improved security and performance.. openSUSE update, webkit2gtk3 fix, important security issues, memory handling fix. . Severity: Important. LinuxSecurity.com Team
Jun 30, 2026
•Important
OpenSUSE
100
security advisoryimportantmalicious contentSUSE webkit2gtk3 Important Memory Handling Crash Issues 2026-2623-1
An update that solves 16 vulnerabilities can now be installed.. # Security update for webkit2gtk3 Announcement ID: SUSE-SU-2026:2623-1 Release Date: 2026-06-24T12:45:47Z Rating: important References: * bsc#1267506 * bsc#1267507 * bsc#1267508 * bsc#1267509 * bsc#1267510 * bsc#1267511 * bsc#1267512 * bsc#1267513 * bsc#1267514 * bsc#1267515 * bsc#1267516 * bsc#1267517 * bsc#1267518 * bsc#1267519 * bsc#1267520 * bsc#1267521 Cross-References: * CVE-2026-28847 * CVE-2026-28883 * CVE-2026-28901 * CVE-2026-28902 * CVE-2026-28903 * CVE-2026-28904 * CVE-2026-28905 * CVE-2026-28907 * CVE-2026-28942 * CVE-2026-28946 * CVE-2026-28947 * CVE-2026-28953 * CVE-2026-28955 * CVE-2026-28958 * CVE-2026-43658 * CVE-2026-43660 CVSS scores: * CVE-2026-28847 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28847 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28847 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28883 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28883 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28883 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28901 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28901 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28901 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-28902 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28902 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28902 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28903 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28904 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28905 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28905 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28905 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-28907 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-28942 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28942 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28942 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28946 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28946 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28946 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28947 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28947 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28947 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28953 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28953 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28955 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28955 ( SUSE ): 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28955 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-28958 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-28958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-28958 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-43658 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-43658 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-43658 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-43660 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves 16 vulnerabilities can now be installed. ## Description: This update for webkit2gtk3 fixes the following issues Update to version 2.52.4: * CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code execution due to a heap buffer overflow (bsc#1267506). * CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after- free issue (bsc#1267507). * CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267508). * CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267509). * CVE-2026-28903: processingmaliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267510). * CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267511). * CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267512). * CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to improper input validation (bsc#1267513). * CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free (bsc#1267514). * CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267515). * CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267516). * CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267517). * CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267518). * CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519). * CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due to improper memory handling (bsc#1267520). * CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to issues with logic (bsc#1267521). Changes: * Add support for half-width fonts. * Improve content filter compilation by avoiding file copies. * Improve handling of out of disk space conditions when the NetworkProcess tried to write data in caches. * Improve how the CMake build system checks whether libatomicis required. * Fix painting scrollbars when their width changes. * Fix playback of certain YouTube videos with low frame rates. * Fix webkit://gpu not working in systems where neither libGL.so.1 nor libOpenGL.so.0 are available. * Fix the build with librice 0.4 or newer when the GStreamer WebRTC backend is enabled at build configuration time. * Fix the build with USE_GSTREAMER_WEBRTC=OFF. * Fix the build with USE_GBM=OFF. * Fix several crashes and rendering issues. * Security fixes: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902, CVE-2026-28903,, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, CVe-2026-43660. * Add support for the "scrollbar-color" CSS property. * Fix some emoji glyphs being rendered as missing glyph boxes. * Fix JavaScriptCore crashes on architectures other than x86_64. * Fix the build on s390x. * Improve handling of real-time threads. * Fix scrollbar rendering glitches visible in some GPU configurations. * Fix V4L2 hardware accelerated media codecs now working due to overly restrictive sandbox device access rules. * Fix leak of bitmap images in webkit_favicon_database_get_favicon_finish(). * Fix the build with USE_GTK4=OFF. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-2623=1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-2623=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64) * libjavascriptcoregtk-4_0-18-2.52.4-4.60.2 * webkit2gtk3-debugsource-2.52.4-4.60.2 * libwebkit2gtk-4_0-37-2.52.4-4.60.2 * typelib-1_0-JavaScriptCore-4_0-2.52.4-4.60.2 * typelib-1_0-WebKit2-4_0-2.52.4-4.60.2 * webkit2gtk-4_0-injected-bundles-2.52.4-4.60.2 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-4.60.2 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-4.60.2 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-4.60.2 * webkit2gtk3-devel-2.52.4-4.60.2 * SUSE Linux Enterprise Server 12 SP5 LTSS (noarch) * libwebkit2gtk3-lang-2.52.4-4.60.2 * SUSE Linux Enterprise Server 12 SP5 LTSS (ppc64le s390x x86_64) * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-4.60.2 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * libjavascriptcoregtk-4_0-18-2.52.4-4.60.2 * webkit2gtk3-debugsource-2.52.4-4.60.2 * libwebkit2gtk-4_0-37-2.52.4-4.60.2 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-4.60.2 * typelib-1_0-JavaScriptCore-4_0-2.52.4-4.60.2 * typelib-1_0-WebKit2-4_0-2.52.4-4.60.2 * webkit2gtk-4_0-injected-bundles-2.52.4-4.60.2 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-4.60.2 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-4.60.2 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-4.60.2 * webkit2gtk3-devel-2.52.4-4.60.2 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch) * libwebkit2gtk3-lang-2.52.4-4.60.2 ## References: * https://www.suse.com/security/cve/CVE-2026-28847.html * https://www.suse.com/security/cve/CVE-2026-28883.html * https://www.suse.com/security/cve/CVE-2026-28901.html * https://www.suse.com/security/cve/CVE-2026-28902.html * https://www.suse.com/security/cve/CVE-2026-28903.html * https://www.suse.com/security/cve/CVE-2026-28904.html * https://www.suse.com/security/cve/CVE-2026-28905.html * https://www.suse.com/security/cve/CVE-2026-28907.html * https://www.suse.com/security/cve/CVE-2026-28942.html * https://www.suse.com/security/cve/CVE-2026-28946.html * https://www.suse.com/security/cve/CVE-2026-28947.html * https://www.suse.com/security/cve/CVE-2026-28953.html *https://www.suse.com/security/cve/CVE-2026-28955.html * https://www.suse.com/security/cve/CVE-2026-28958.html * https://www.suse.com/security/cve/CVE-2026-43658.html * https://www.suse.com/security/cve/CVE-2026-43660.html * https://bugzilla.suse.com/show_bug.cgi?id=1267506 * https://bugzilla.suse.com/show_bug.cgi?id=1267507 * https://bugzilla.suse.com/show_bug.cgi?id=1267508 * https://bugzilla.suse.com/show_bug.cgi?id=1267509 * https://bugzilla.suse.com/show_bug.cgi?id=1267510 * https://bugzilla.suse.com/show_bug.cgi?id=1267511 * https://bugzilla.suse.com/show_bug.cgi?id=1267512 * https://bugzilla.suse.com/show_bug.cgi?id=1267513 * https://bugzilla.suse.com/show_bug.cgi?id=1267514 * https://bugzilla.suse.com/show_bug.cgi?id=1267515 * https://bugzilla.suse.com/show_bug.cgi?id=1267516 * https://bugzilla.suse.com/show_bug.cgi?id=1267517 * https://bugzilla.suse.com/show_bug.cgi?id=1267518 * https://bugzilla.suse.com/show_bug.cgi?id=1267519 * https://bugzilla.suse.com/show_bug.cgi?id=1267520 * https://bugzilla.suse.com/show_bug.cgi?id=1267521 . This update addresses significant vulnerabilities in webkit2gtk3, improving security against crafted web content attacks. . SUSE webkit2gtk3 update, important updates SUSE, software vulnerabilities fixed. . Severity: Important. LinuxSecurity.com Team
Jun 24, 2026
•Important
SuSE
172
security advisorydenial of serviceUbuntuUbuntu 26.04 LTS FFmpeg Critical Denial of Service Issues USN-8469-1
Several security issues were fixed in FFmpeg.. ========================================================================== Ubuntu Security Notice USN-8469-1 June 24, 2026 ffmpeg vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in FFmpeg. Software Description: - ffmpeg: Tools for transcoding, streaming and playing of multimedia files Details: Jiasheng Jiang discovered that FFmpeg incorrectly handled memory in certain error-handling paths of its TensorFlow DNN backend. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2025-12343) Quang Luong discovered that FFmpeg incorrectly handled certain subsample data. An attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-40962) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS ffmpeg 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavcodec-dev 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavcodec-extra 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavcodec-extra62 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavcodec62 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavdevice-dev 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavdevice62 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavfilter-dev 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavfilter-extra 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavfilter-extra11 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavfilter11 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavformat-dev 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavformat-extra 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavformat-extra62 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavformat62 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavutil-dev 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libavutil60 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libswresample-dev 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libswresample6 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libswscale-dev 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro libswscale9 7:8.0.1-3ubuntu2+esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS ffmpeg 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavcodec-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavcodec-extra 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavcodec-extra60 7:6.1.1-3ubuntu5+esm10 Available withUbuntu Pro libavcodec60 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavdevice-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavdevice60 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavfilter-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavfilter-extra 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavfilter-extra9 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavfilter9 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavformat-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavformat-extra 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavformat-extra60 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavformat60 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavutil-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libavutil58 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libpostproc-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libpostproc57 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libswresample-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libswresample4 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libswscale-dev 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro libswscale7 7:6.1.1-3ubuntu5+esm10 Available with Ubuntu Pro Ubuntu 22.04 LTS ffmpeg 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavcodec-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavcodec-extra 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavcodec-extra58 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavcodec58 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavdevice-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavdevice58 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavfilter-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavfilter-extra 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavfilter-extra7 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavfilter7 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavformat-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavformat-extra 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavformat-extra58 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavformat58 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavutil-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libavutil56 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libpostproc-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libpostproc55 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libswresample-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libswresample3 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libswscale-dev 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro libswscale5 7:4.4.2-0ubuntu0.22.04.1+esm12 Available with Ubuntu Pro Ubuntu 20.04 LTS ffmpeg 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavcodec-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavcodec-extra 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavcodec-extra58 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavcodec58 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavdevice-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavdevice58 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavfilter-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavfilter-extra 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavfilter-extra7 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavfilter7 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavformat-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavformat58 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavresample-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavresample4 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavutil-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libavutil56 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libpostproc-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libpostproc55 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libswresample-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libswresample3 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libswscale-dev 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro libswscale5 7:4.2.7-0ubuntu0.1+esm13 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8469-1 CVE-2025-12343, CVE-2026-40962 . Security updates for FFmpeg fix several issues affecting Ubuntu users across multiple LTS versions, mitigating potentialattacks.. FFmpeg security update, Ubuntu security notice, multimedia tools update. . Severity: Critical. LinuxSecurity.com Team
Jun 24, 2026
•Critical
Ubuntu
100
security advisoryimportantcrashopenSUSE Webkit2gtk3 Important Security Update 2026-2378-1
An update that solves 16 vulnerabilities can now be installed.. # Security update for webkit2gtk3 Announcement ID: SUSE-SU-2026:2378-1 Release Date: 2026-06-11T16:10:30Z Rating: important References: * bsc#1267506 * bsc#1267507 * bsc#1267508 * bsc#1267509 * bsc#1267510 * bsc#1267511 * bsc#1267512 * bsc#1267513 * bsc#1267514 * bsc#1267515 * bsc#1267516 * bsc#1267517 * bsc#1267518 * bsc#1267519 * bsc#1267520 * bsc#1267521 Cross-References: * CVE-2026-28847 * CVE-2026-28883 * CVE-2026-28901 * CVE-2026-28902 * CVE-2026-28903 * CVE-2026-28904 * CVE-2026-28905 * CVE-2026-28907 * CVE-2026-28942 * CVE-2026-28946 * CVE-2026-28947 * CVE-2026-28953 * CVE-2026-28955 * CVE-2026-28958 * CVE-2026-43658 * CVE-2026-43660 CVSS scores: * CVE-2026-28847 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28847 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28847 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28883 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28883 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28883 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28901 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28901 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28901 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-28902 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28902 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28902 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28903 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28904 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28905 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28905 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28905 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-28907 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-28942 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28942 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28942 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28946 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28946 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28946 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28947 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28947 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28947 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28953 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28953 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28955 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28955 ( SUSE ): 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28955 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-28958 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-28958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-28958 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-43658 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-43658 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-43658 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-43660 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves 16 vulnerabilities can now be installed. ## Description: This update for webkit2gtk3 fixes the following issues Update to version 2.52.4: * CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code execution due to a heap buffer overflow (bsc#1267506). * CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after- free issue (bsc#1267507). * CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crashdue to improper memory handling (bsc#1267508). * CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267509). * CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267510). * CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267511). * CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267512). * CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to improper input validation (bsc#1267513). * CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free (bsc#1267514). * CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267515). * CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267516). * CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267517). * CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267518). * CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519). * CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due to improper memory handling (bsc#1267520). * CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to issues with logic (bsc#1267521). Changes: * Add support for half-width fonts. *Improve content filter compilation by avoiding file copies. * Improve handling of out of disk space conditions when the NetworkProcess tried to write data in caches. * Improve how the CMake build system checks whether libatomic is required. * Fix painting scrollbars when their width changes. * Fix playback of certain YouTube videos with low frame rates. * Fix webkit://gpu not working in systems where neither libGL.so.1 nor libOpenGL.so.0 are available. * Fix the build with librice 0.4 or newer when the GStreamer WebRTC backend is enabled at build configuration time. * Fix the build with USE_GSTREAMER_WEBRTC=OFF. * Fix the build with USE_GBM=OFF. * Fix several crashes and rendering issues. * Add support for the "scrollbar-color" CSS property. * Fix some emoji glyphs being rendered as missing glyph boxes. * Fix JavaScriptCore crashes on architectures other than x86_64. * Fix the build on s390x. * Changes in version 2.52.2: * Improve handling of real-time threads. * Fix scrollbar rendering glitches visible in some GPU configurations. * Fix V4L2 hardware accelerated media codecs now working due to overly restrictive sandbox device access rules. * Fix leak of bitmap images in webkit_favicon_database_get_favicon_finish(). * Fix the build with USE_GTK4=OFF. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-2378=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-2378=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-2378=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-2378=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-2378=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-2378=1 ## Package List: * openSUSE Leap 15.4 (noarch) * WebKitGTK-4.1-lang-2.52.4-150400.4.143.1 * WebKitGTK-4.0-lang-2.52.4-150400.4.143.1 * WebKitGTK-6.0-lang-2.52.4-150400.4.143.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * webkit-jsc-4-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-2.52.4-150400.4.143.1 * webkitgtk-6_0-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk4-debugsource-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-minibrowser-2.52.4-150400.4.143.1 * webkit-jsc-4.1-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-minibrowser-debuginfo-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_1-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * webkit-jsc-6.0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit-6_0-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150400.4.143.1 * webkit-jsc-6.0-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk4-devel-2.52.4-150400.4.143.1 * webkit-jsc-4.1-2.52.4-150400.4.143.1 * webkit-jsc-4-2.52.4-150400.4.143.1 * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.4-150400.4.143.1 * webkit2gtk3-devel-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-debugsource-2.52.4-150400.4.143.1 * webkit2gtk4-minibrowser-2.52.4-150400.4.143.1 * webkitgtk-6_0-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk3-minibrowser-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_0-2.52.4-150400.4.143.1 * webkit2gtk4-minibrowser-debuginfo-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150400.4.143.1 * webkit2gtk3-minibrowser-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-6_0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk3-debugsource-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-devel-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-2.52.4-150400.4.143.1 * openSUSE Leap 15.4 (x86_64) * libjavascriptcoregtk-4_0-18-32bit-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-32bit-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-32bit-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-32bit-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-32bit-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-32bit-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-32bit-debuginfo-2.52.4-150400.4.143.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libjavascriptcoregtk-4_1-0-64bit-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-64bit-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-64bit-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-64bit-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-64bit-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-64bit-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-64bit-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-64bit-2.52.4-150400.4.143.1 * SUSE Linux EnterpriseHigh Performance Computing ESPOS 15 SP4 (noarch) * WebKitGTK-4.1-lang-2.52.4-150400.4.143.1 * WebKitGTK-4.0-lang-2.52.4-150400.4.143.1 * WebKitGTK-6.0-lang-2.52.4-150400.4.143.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libwebkit2gtk-4_0-37-2.52.4-150400.4.143.1 * webkitgtk-6_0-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk4-debugsource-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_1-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150400.4.143.1 * webkit2gtk3-devel-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-debugsource-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_0-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk3-debugsource-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-devel-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-2.52.4-150400.4.143.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * WebKitGTK-4.1-lang-2.52.4-150400.4.143.1 *WebKitGTK-4.0-lang-2.52.4-150400.4.143.1 * WebKitGTK-6.0-lang-2.52.4-150400.4.143.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * libwebkit2gtk-4_0-37-2.52.4-150400.4.143.1 * webkitgtk-6_0-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk4-debugsource-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_1-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150400.4.143.1 * webkit2gtk3-devel-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-debugsource-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_0-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk3-debugsource-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-devel-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-2.52.4-150400.4.143.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * WebKitGTK-4.1-lang-2.52.4-150400.4.143.1 * WebKitGTK-4.0-lang-2.52.4-150400.4.143.1 * WebKitGTK-6.0-lang-2.52.4-150400.4.143.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (ppc64le s390x x86_64) * libwebkit2gtk-4_0-37-2.52.4-150400.4.143.1 * webkitgtk-6_0-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk4-debugsource-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_1-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150400.4.143.1 * webkit2gtk3-devel-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-debugsource-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_0-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk3-debugsource-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-devel-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-2.52.4-150400.4.143.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * WebKitGTK-4.1-lang-2.52.4-150400.4.143.1 * WebKitGTK-4.0-lang-2.52.4-150400.4.143.1 * WebKitGTK-6.0-lang-2.52.4-150400.4.143.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 s390x) * libwebkit2gtk-4_0-37-2.52.4-150400.4.143.1 * webkitgtk-6_0-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150400.4.143.1 *webkit2gtk4-debugsource-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_1-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150400.4.143.1 * webkit2gtk3-devel-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-debugsource-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_0-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk3-debugsource-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-devel-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-2.52.4-150400.4.143.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * WebKitGTK-4.1-lang-2.52.4-150400.4.143.1 * WebKitGTK-4.0-lang-2.52.4-150400.4.143.1 * WebKitGTK-6.0-lang-2.52.4-150400.4.143.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le) * libwebkit2gtk-4_0-37-2.52.4-150400.4.143.1 * webkitgtk-6_0-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk4-debugsource-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150400.4.143.1 *libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150400.4.143.1 * libjavascriptcoregtk-6_0-1-2.52.4-150400.4.143.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_1-2.52.4-150400.4.143.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_1-0-2.52.4-150400.4.143.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150400.4.143.1 * webkit2gtk3-devel-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-debugsource-2.52.4-150400.4.143.1 * typelib-1_0-WebKit2-4_0-2.52.4-150400.4.143.1 * libwebkitgtk-6_0-4-2.52.4-150400.4.143.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150400.4.143.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150400.4.143.1 * webkit2gtk3-debugsource-2.52.4-150400.4.143.1 * webkit2gtk3-soup2-devel-2.52.4-150400.4.143.1 * libwebkit2gtk-4_1-0-2.52.4-150400.4.143.1 ## References: * https://www.suse.com/security/cve/CVE-2026-28847.html * https://www.suse.com/security/cve/CVE-2026-28883.html * https://www.suse.com/security/cve/CVE-2026-28901.html * https://www.suse.com/security/cve/CVE-2026-28902.html * https://www.suse.com/security/cve/CVE-2026-28903.html * https://www.suse.com/security/cve/CVE-2026-28904.html * https://www.suse.com/security/cve/CVE-2026-28905.html * https://www.suse.com/security/cve/CVE-2026-28907.html * https://www.suse.com/security/cve/CVE-2026-28942.html * https://www.suse.com/security/cve/CVE-2026-28946.html * https://www.suse.com/security/cve/CVE-2026-28947.html * https://www.suse.com/security/cve/CVE-2026-28953.html *https://www.suse.com/security/cve/CVE-2026-28955.html * https://www.suse.com/security/cve/CVE-2026-28958.html * https://www.suse.com/security/cve/CVE-2026-43658.html * https://www.suse.com/security/cve/CVE-2026-43660.html * https://bugzilla.suse.com/show_bug.cgi?id=1267506 * https://bugzilla.suse.com/show_bug.cgi?id=1267507 * https://bugzilla.suse.com/show_bug.cgi?id=1267508 * https://bugzilla.suse.com/show_bug.cgi?id=1267509 * https://bugzilla.suse.com/show_bug.cgi?id=1267510 * https://bugzilla.suse.com/show_bug.cgi?id=1267511 * https://bugzilla.suse.com/show_bug.cgi?id=1267512 * https://bugzilla.suse.com/show_bug.cgi?id=1267513 * https://bugzilla.suse.com/show_bug.cgi?id=1267514 * https://bugzilla.suse.com/show_bug.cgi?id=1267515 * https://bugzilla.suse.com/show_bug.cgi?id=1267516 * https://bugzilla.suse.com/show_bug.cgi?id=1267517 * https://bugzilla.suse.com/show_bug.cgi?id=1267518 * https://bugzilla.suse.com/show_bug.cgi?id=1267519 * https://bugzilla.suse.com/show_bug.cgi?id=1267520 * https://bugzilla.suse.com/show_bug.cgi?id=1267521 . Security update for webkit2gtk3 resolves 16 vulnerabilities in openSUSE, ensuring safer web content handling. Install now!. openSUSE update, webkit2gtk3 security, important update, memory handling issues, open source security. . Severity: Important. LinuxSecurity.com Team
Jun 11, 2026
•Important
SuSE
100
security advisorySuSEimportantSUSE Linux Micro FreeIPMI Important Memory Issue Fix 2026-21680-1
An update that solves one vulnerability can now be installed.. # Security update for freeipmi Announcement ID: SUSE-SU-2026:21680-1 Release Date: 2026-05-15T10:48:06Z Rating: important References: * bsc#1260414 Cross-References: * CVE-2026-33554 CVSS scores: * CVE-2026-33554 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-33554 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H * CVE-2026-33554 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Micro 6.0 An update that solves one vulnerability can now be installed. ## Description: This update for freeipmi fixes the following issue * CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and acceptance of malformed payloads/responses (bsc#1260414). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.0 zypper in -t patch SUSE-SLE-Micro-6.0-706=1 ## Package List: * SUSE Linux Micro 6.0 (aarch64 x86_64) * libfreeipmi17-debuginfo-1.6.11-2.1 * freeipmi-debugsource-1.6.11-2.1 * libfreeipmi17-1.6.11-2.1 ## References: * https://www.suse.com/security/cve/CVE-2026-33554.html * https://bugzilla.suse.com/show_bug.cgi?id=1260414 . An important security update for freeipmi addresses a memory handling issue, preventing stack overflows in SUSE Linux.. SUSE Linux, important update, freeipmi security, stack overflow, memory handling. . Severity: Important. LinuxSecurity.com Team
May 19, 2026
•Important
SuSE
100
security advisorybuffer overflowSuSESUSE Linux 12 SP5 Freeipmi Important Memory Handling Issue CVE-2026-33554
An update that solves one vulnerability can now be installed.. # Security update for freeipmi Announcement ID: SUSE-SU-2026:1754-1 Release Date: 2026-05-07T13:54:30Z Rating: important References: * bsc#1260414 Cross-References: * CVE-2026-33554 CVSS scores: * CVE-2026-33554 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-33554 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H * CVE-2026-33554 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for freeipmi fixes the following issue: * CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and acceptance of malformed payloads/responses (bsc#1260414). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-1754=1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1754=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 x86_64) * freeipmi-debuginfo-1.5.7-3.6.1 * freeipmi-1.5.7-3.6.1 * libipmimonitoring6-debuginfo-1.5.7-3.6.1 * libipmimonitoring6-1.5.7-3.6.1 * libipmiconsole2-1.5.7-3.6.1 * libipmidetect0-debuginfo-1.5.7-3.6.1 * libfreeipmi17-1.5.7-3.6.1 * freeipmi-debugsource-1.5.7-3.6.1 * libfreeipmi17-debuginfo-1.5.7-3.6.1 *libipmiconsole2-debuginfo-1.5.7-3.6.1 * freeipmi-devel-1.5.7-3.6.1 * libipmidetect0-1.5.7-3.6.1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * freeipmi-debuginfo-1.5.7-3.6.1 * freeipmi-1.5.7-3.6.1 * libipmimonitoring6-debuginfo-1.5.7-3.6.1 * libipmimonitoring6-1.5.7-3.6.1 * libipmiconsole2-1.5.7-3.6.1 * libipmidetect0-debuginfo-1.5.7-3.6.1 * libfreeipmi17-1.5.7-3.6.1 * freeipmi-debugsource-1.5.7-3.6.1 * libfreeipmi17-debuginfo-1.5.7-3.6.1 * libipmiconsole2-debuginfo-1.5.7-3.6.1 * freeipmi-devel-1.5.7-3.6.1 * libipmidetect0-1.5.7-3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2026-33554.html * https://bugzilla.suse.com/show_bug.cgi?id=1260414 . Update for freeipmi addresses important memory handling issue, fixing stack buffer overflows and malformed payloads.. freeipmi update,SUSE security patch,memory handling issue,buffer overflow fix. . Severity: Important. LinuxSecurity.com Team
May 07, 2026
•Important
SuSE
100
security advisorybuffer overflowSuSESUSE Linux Micro 6.2 FreeIPMI Important Memory Handling Issue 21231-1
An update that solves one vulnerability can now be installed.. # Security update for freeipmi Announcement ID: SUSE-SU-2026:21231-1 Release Date: 2026-04-17T07:57:36Z Rating: important References: * bsc#1260414 Cross-References: * CVE-2026-33554 CVSS scores: * CVE-2026-33554 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2026-33554 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H * CVE-2026-33554 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Micro 6.2 An update that solves one vulnerability can now be installed. ## Description: This update for freeipmi fixes the following issue: * CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and acceptance of malformed payloads/responses (bsc#1260414). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.2 zypper in -t patch SUSE-SL-Micro-6.2-579=1 ## Package List: * SUSE Linux Micro 6.2 (aarch64 x86_64) * libfreeipmi17-debuginfo-1.6.15-160000.3.1 * freeipmi-debugsource-1.6.15-160000.3.1 * libfreeipmi17-1.6.15-160000.3.1 * freeipmi-debuginfo-1.6.15-160000.3.1 ## References: * https://www.suse.com/security/cve/CVE-2026-33554.html * https://bugzilla.suse.com/show_bug.cgi?id=1260414 . SUSE Linux Micro 6.2 receives an important update for FreeIPMI to fix memory handling issues and improve stability.. Linux Micro, FreeIPMI, SUSE Update, Memory Handling, Security Fixes. . Severity: Important. LinuxSecurity.com Team
Apr 22, 2026
•Important
SuSE
100
security advisorySuSEimportantSUSE Webkit2gtk3 Important Patch 2026-21180-1 Improves Security
An update that solves 25 vulnerabilities can now be installed.. # Security update for webkit2gtk3 Announcement ID: SUSE-SU-2026:21180-1 Release Date: 2026-04-13T11:47:50Z Rating: important References: * bsc#1259934 * bsc#1259935 * bsc#1259936 * bsc#1259937 * bsc#1259938 * bsc#1259939 * bsc#1259940 * bsc#1259941 * bsc#1259942 * bsc#1259943 * bsc#1259944 * bsc#1259945 * bsc#1259946 * bsc#1259947 * bsc#1259948 * bsc#1259949 * bsc#1259950 * bsc#1261172 * bsc#1261173 * bsc#1261174 * bsc#1261175 * bsc#1261176 * bsc#1261177 * bsc#1261178 * bsc#1261179 Cross-References: * CVE-2023-43010 * CVE-2025-31223 * CVE-2025-31277 * CVE-2025-43213 * CVE-2025-43214 * CVE-2025-43433 * CVE-2025-43438 * CVE-2025-43441 * CVE-2025-43457 * CVE-2025-43511 * CVE-2025-46299 * CVE-2026-20608 * CVE-2026-20635 * CVE-2026-20636 * CVE-2026-20643 * CVE-2026-20644 * CVE-2026-20652 * CVE-2026-20664 * CVE-2026-20665 * CVE-2026-20676 * CVE-2026-20691 * CVE-2026-28857 * CVE-2026-28859 * CVE-2026-28861 * CVE-2026-28871 CVSS scores: * CVE-2023-43010 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2023-43010 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-43010 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-31223 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-31223 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-31223 ( NVD ): 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2025-31277 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-31277 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-31277 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-43213 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43213 ( NVD ): 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43214 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-43214 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-43214 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43433 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-43433 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-43433 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-43438 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-43438 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-43438 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2025-43441 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2025-43441 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43441 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2025-43457 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-43457 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-43457 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43511 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-43511 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-43511 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-46299 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-46299 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2025-46299 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-20608 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-20608 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H *CVE-2026-20608 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-20635 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-20635 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-20635 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-20636 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-20636 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-20636 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-20643 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-20643 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-20644 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-20644 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-20644 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-20652 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-20652 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-20652 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-20652 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-20664 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-20664 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-20665 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L * CVE-2026-20665 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2026-20676 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-20676 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-20676 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-20676 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-20691 ( SUSE ): 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-20691 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-28857 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28857 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28859 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-28859 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-28861 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N * CVE-2026-28861 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-28871 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-28871 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves 25 vulnerabilities can now be installed. ## Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.52.1. Security issues fixed: * CVE-2025-43213: processing maliciously crafted web content may lead to an unexpected crash due to improper memory handling (bsc#1259947). * CVE-2025-43214: processing maliciously crafted web content may lead to an unexpected crash due to improper memory handling (bsc#1259946). * CVE-2025-43457: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free (bsc#1259942). * CVE-2025-43511: processing maliciously crafted web content may lead to an unexpected process crash due to use-after-free (bsc#1259941). * CVE-2025-46299: processing maliciously crafted web content may disclose internal states of an app due to improper memory initialization (bsc#1259940). * CVE-2026-20608: processing maliciously crafted web content may lead to an unexpected process crash due to improper state management (bsc#1259939). * CVE-2026-20635: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1259938). * CVE-2026-20636: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1259937). * CVE-2026-20643: processing maliciously crafted web content may bypass Same Origin Policy due to improper input validation (bsc#1261172). * CVE-2026-20644: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1259936). * CVE-2026-20652: a remote attacker may be able to cause a denial-of-service due to improper memory handling (bsc#1259935). * CVE-2026-20664: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1261173). * CVE-2026-20665: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to improper state management (bsc#1261174). * CVE-2026-20676: a website may be able to track users through web extensions due to improper state management (bsc#1259934). * CVE-2026-20691: a maliciously crafted webpage may be able to fingerprint users due to improper state management (bsc#1261175). * CVE-2026-28857: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1261176). * CVE-2026-28859: a malicious website may be able to process restricted web content outside the sandbox due to improper memory management (bsc#1261177). * CVE-2026-28861: a malicious website may be able to access script message handlers intended for other origins due to improper state management (bsc#1261178). * CVE-2026-28871: visiting a maliciously crafted website may lead to a cross- site scripting attack due to missing checks (bsc#1261179). Other updates and bugfixes: * Version 2.52.1: * Reduce the amount of useless MPRIS notifications produced by MediaSession when the information about media beingplayed is incomplete. * Support turning off USE_GSTREAMER to configure the build with all multimedia features disabled. * Add Sysprof marks for mouse events. * Fix MediaSession icon for iheart.com not being displayed. * Fix the build with USE_GSTREAMER_GL disabled. * Fix the build with librice version 0.3.0 or newer. * Fix several crashes and rendering issues. * Translation updates: Georgian. * Version 2.52.0: * Make scrolling with touch input smoother for small movements. * Fix estimated load progress of downloads when Content-Length value is wrong. * Ensure that "scrollend" events are correctly emitted after scroll animations. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-540=1 * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-540=1 ## Package List: * SUSE Linux Enterprise Server 16.0 (noarch) * WebKitGTK-6.0-lang-2.52.1-160000.1.1 * WebKitGTK-4.1-lang-2.52.1-160000.1.1 * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64) * webkit2gtk-4_1-injected-bundles-2.52.1-160000.1.1 * typelib-1_0-WebKit2-4_1-2.52.1-160000.1.1 * libwebkitgtk-6_0-4-debuginfo-2.52.1-160000.1.1 * webkit2gtk4-minibrowser-debuginfo-2.52.1-160000.1.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.1-160000.1.1 * webkit-jsc-6.0-debuginfo-2.52.1-160000.1.1 * webkit-jsc-4.1-debuginfo-2.52.1-160000.1.1 * webkit-jsc-6.0-2.52.1-160000.1.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.1-160000.1.1 * webkit2gtk3-minibrowser-debuginfo-2.52.1-160000.1.1 * webkit2gtk3-minibrowser-2.52.1-160000.1.1 * libwebkitgtk-6_0-4-2.52.1-160000.1.1 * libjavascriptcoregtk-4_1-0-2.52.1-160000.1.1 * webkit2gtk4-minibrowser-2.52.1-160000.1.1 *webkit2gtk-4_1-injected-bundles-debuginfo-2.52.1-160000.1.1 * webkit-jsc-4.1-2.52.1-160000.1.1 * typelib-1_0-JavaScriptCore-6_0-2.52.1-160000.1.1 * libwebkit2gtk-4_1-0-2.52.1-160000.1.1 * typelib-1_0-JavaScriptCore-4_1-2.52.1-160000.1.1 * webkitgtk-6_0-injected-bundles-2.52.1-160000.1.1 * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.1-160000.1.1 * libjavascriptcoregtk-6_0-1-2.52.1-160000.1.1 * webkitgtk-6_0-injected-bundles-debuginfo-2.52.1-160000.1.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.1-160000.1.1 * typelib-1_0-WebKit-6_0-2.52.1-160000.1.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.1-160000.1.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch) * WebKitGTK-6.0-lang-2.52.1-160000.1.1 * WebKitGTK-4.1-lang-2.52.1-160000.1.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64) * webkit2gtk-4_1-injected-bundles-2.52.1-160000.1.1 * typelib-1_0-WebKit2-4_1-2.52.1-160000.1.1 * libwebkitgtk-6_0-4-debuginfo-2.52.1-160000.1.1 * webkit2gtk4-minibrowser-debuginfo-2.52.1-160000.1.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.1-160000.1.1 * webkit-jsc-6.0-debuginfo-2.52.1-160000.1.1 * webkit-jsc-4.1-debuginfo-2.52.1-160000.1.1 * webkit-jsc-6.0-2.52.1-160000.1.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.1-160000.1.1 * webkit2gtk3-minibrowser-debuginfo-2.52.1-160000.1.1 * webkit2gtk3-minibrowser-2.52.1-160000.1.1 * libwebkitgtk-6_0-4-2.52.1-160000.1.1 * libjavascriptcoregtk-4_1-0-2.52.1-160000.1.1 * webkit2gtk4-minibrowser-2.52.1-160000.1.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.1-160000.1.1 * webkit-jsc-4.1-2.52.1-160000.1.1 * typelib-1_0-JavaScriptCore-6_0-2.52.1-160000.1.1 * libwebkit2gtk-4_1-0-2.52.1-160000.1.1 * typelib-1_0-JavaScriptCore-4_1-2.52.1-160000.1.1 * webkitgtk-6_0-injected-bundles-2.52.1-160000.1.1 * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.1-160000.1.1 * libjavascriptcoregtk-6_0-1-2.52.1-160000.1.1 *webkitgtk-6_0-injected-bundles-debuginfo-2.52.1-160000.1.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.1-160000.1.1 * typelib-1_0-WebKit-6_0-2.52.1-160000.1.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.1-160000.1.1 ## References: * https://www.suse.com/security/cve/CVE-2023-43010.html * https://www.suse.com/security/cve/CVE-2025-31223.html * https://www.suse.com/security/cve/CVE-2025-31277.html * https://www.suse.com/security/cve/CVE-2025-43213.html * https://www.suse.com/security/cve/CVE-2025-43214.html * https://www.suse.com/security/cve/CVE-2025-43433.html * https://www.suse.com/security/cve/CVE-2025-43438.html * https://www.suse.com/security/cve/CVE-2025-43441.html * https://www.suse.com/security/cve/CVE-2025-43457.html * https://www.suse.com/security/cve/CVE-2025-43511.html * https://www.suse.com/security/cve/CVE-2025-46299.html * https://www.suse.com/security/cve/CVE-2026-20608.html * https://www.suse.com/security/cve/CVE-2026-20635.html * https://www.suse.com/security/cve/CVE-2026-20636.html * https://www.suse.com/security/cve/CVE-2026-20643.html * https://www.suse.com/security/cve/CVE-2026-20644.html * https://www.suse.com/security/cve/CVE-2026-20652.html * https://www.suse.com/security/cve/CVE-2026-20664.html * https://www.suse.com/security/cve/CVE-2026-20665.html * https://www.suse.com/security/cve/CVE-2026-20676.html * https://www.suse.com/security/cve/CVE-2026-20691.html * https://www.suse.com/security/cve/CVE-2026-28857.html * https://www.suse.com/security/cve/CVE-2026-28859.html * https://www.suse.com/security/cve/CVE-2026-28861.html * https://www.suse.com/security/cve/CVE-2026-28871.html * https://bugzilla.suse.com/show_bug.cgi?id=1259934 * https://bugzilla.suse.com/show_bug.cgi?id=1259935 * https://bugzilla.suse.com/show_bug.cgi?id=1259936 * https://bugzilla.suse.com/show_bug.cgi?id=1259937 * https://bugzilla.suse.com/show_bug.cgi?id=1259938 * https://bugzilla.suse.com/show_bug.cgi?id=1259939 *https://bugzilla.suse.com/show_bug.cgi?id=1259940 * https://bugzilla.suse.com/show_bug.cgi?id=1259941 * https://bugzilla.suse.com/show_bug.cgi?id=1259942 * https://bugzilla.suse.com/show_bug.cgi?id=1259943 * https://bugzilla.suse.com/show_bug.cgi?id=1259944 * https://bugzilla.suse.com/show_bug.cgi?id=1259945 * https://bugzilla.suse.com/show_bug.cgi?id=1259946 * https://bugzilla.suse.com/show_bug.cgi?id=1259947 * https://bugzilla.suse.com/show_bug.cgi?id=1259948 * https://bugzilla.suse.com/show_bug.cgi?id=1259949 * https://bugzilla.suse.com/show_bug.cgi?id=1259950 * https://bugzilla.suse.com/show_bug.cgi?id=1261172 * https://bugzilla.suse.com/show_bug.cgi?id=1261173 * https://bugzilla.suse.com/show_bug.cgi?id=1261174 * https://bugzilla.suse.com/show_bug.cgi?id=1261175 * https://bugzilla.suse.com/show_bug.cgi?id=1261176 * https://bugzilla.suse.com/show_bug.cgi?id=1261177 * https://bugzilla.suse.com/show_bug.cgi?id=1261178 * https://bugzilla.suse.com/show_bug.cgi?id=1261179 . SUSE updates webkit2gtk3 addressing 25 issues; critical memory handling flaws pose crash risks. Update now!. SUSE webkit2gtk3 vulnerabilities memory handling. . Severity: Important. LinuxSecurity.com Team
Apr 21, 2026
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!