Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 649 articles for you...
202
security advisorymoderatebug fixopenSUSE Leap 16.0 perl-HTML-Parser Moderate Memory Issue CVE-2026-8829
An update that solves one vulnerability and has one bug fix can now be installed.. openSUSE security update: security update for perl-html-parser ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21126-1 Rating: moderate References: * bsc#1267606 Cross-References: * CVE-2026-8829 CVSS scores: * CVE-2026-8829 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves one vulnerability and has one bug fix can now be installed. Description: This update for perl-HTML-Parser fixes the following issue - CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in _decode_entities (bsc#1267606). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-991=1 Package List: - openSUSE Leap 16.0: perl-HTML-Parser-3.830.0-160000.3.1 References: * https://www.suse.com/security/cve/CVE-2026-8829.html . Explore the moderate security update for openSUSE's perl-HTML-Parser addressing CVE-2026-8829 and one bug fix.. openSUSE security, perl-HTML-Parser update, CVE-2026-8829, memory leak fix, software patch. . Severity: moderate. LinuxSecurity.com Team
Jun 30, 2026
•moderate
OpenSUSE
197
security advisorycriticalheap corruptionDebian LTS libhtml-parser-perl Critical Heap Corruption Iss DLA-4655-1
Paul Johnson discovered that libhtml-parser-perl, a collection of modules that parse HTML text documents, read freed heap memory in _decode_entities(). For Debian 11 bullseye, this problem has been fixed in version 3.75-1+deb11u1.. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4655-1
Jun 28, 2026
•Critical
Debian LTS
100
security advisorySuSEimportantSUSE webkit2gtk3 Important Memory Issue Fix Advisory 2026-22203-1
An update that solves 16 vulnerabilities can now be installed.. # Security update for webkit2gtk3 Announcement ID: SUSE-SU-2026:22203-1 Release Date: 2026-06-20T09:17:07Z Rating: important References: * bsc#1267506 * bsc#1267507 * bsc#1267508 * bsc#1267509 * bsc#1267510 * bsc#1267511 * bsc#1267512 * bsc#1267513 * bsc#1267514 * bsc#1267515 * bsc#1267516 * bsc#1267517 * bsc#1267518 * bsc#1267519 * bsc#1267520 * bsc#1267521 Cross-References: * CVE-2026-28847 * CVE-2026-28883 * CVE-2026-28901 * CVE-2026-28902 * CVE-2026-28903 * CVE-2026-28904 * CVE-2026-28905 * CVE-2026-28907 * CVE-2026-28942 * CVE-2026-28946 * CVE-2026-28947 * CVE-2026-28953 * CVE-2026-28955 * CVE-2026-28958 * CVE-2026-43658 * CVE-2026-43660 CVSS scores: * CVE-2026-28847 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28847 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28847 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28883 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28883 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28883 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28901 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28901 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28901 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-28902 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28902 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28902 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28903 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28904 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28905 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28905 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28905 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-28907 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-28942 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28942 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28942 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28946 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28946 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28946 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28947 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28947 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28947 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28953 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28953 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28955 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28955 ( SUSE ): 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28955 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-28958 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-28958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-28958 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-43658 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-43658 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-43658 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-43660 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * SUSE Linux Enterprise Server 16.0 An update that solves 16 vulnerabilities can now be installed. ## Description: This update for webkit2gtk3 fixes the following issues Update to version 2.52.4: * CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code execution due to a heap buffer overflow (bsc#1267506). * CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after- free issue (bsc#1267507). * CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267508). * CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267509). * CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267510). * CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due toimproper memory handling (bsc#1267511). * CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267512). * CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to improper input validation (bsc#1267513). * CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free (bsc#1267514). * CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267515). * CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267516). * CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267517). * CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267518). * CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519). * CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due to improper memory handling (bsc#1267520). * CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to issues with logic (bsc#1267521). Changes for webkit2gtk3: * Add support for half-width fonts. * Improve content filter compilation by avoiding file copies. * Improve handling of out of disk space conditions when the NetworkProcess tried to write data in caches. * Improve how the CMake build system checks whether libatomic is required. * Fix painting scrollbars when their width changes. * Fix playback of certain YouTube videos with low frame rates. * Fix webkit://gpu not working in systems where neither libGL.so.1 nor libOpenGL.so.0 are available. * Fix the build with librice 0.4 or newer when the GStreamer WebRTC backend is enabled at build configuration time. * Fix the build with USE_GSTREAMER_WEBRTC=OFF. * Fix the build with USE_GBM=OFF. * Fix several crashes and rendering issues. * Security fixes: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, CVe-2026-43660. * Changes in version .52.3; * Add support for the "scrollbar-color" CSS property. * Fix some emoji glyphs being rendered as missing glyph boxes. * Fix JavaScriptCore crashes on architectures other than x86_64. * Fix the build on s390x. * Changes in version 2.52.2: * Improve handling of real-time threads. * Fix scrollbar rendering glitches visible in some GPU configurations. * Fix V4L2 hardware accelerated media codecs now working due to overly restrictive sandbox device access rules. * Fix leak of bitmap images in webkit_favicon_database_get_favicon_finish(). * Fix the build with USE_GTK4=OFF. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-994=1 ## Package List: * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64) * libjavascriptcoregtk-6_0-1-2.52.4-160000.1.1 * webkit2gtk-4_1-injected-bundles-2.52.4-160000.1.1 * webkit-jsc-4.1-2.52.4-160000.1.1 * typelib-1_0-WebKit-6_0-2.52.4-160000.1.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-160000.1.1 * webkit-jsc-6.0-2.52.4-160000.1.1 * webkitgtk-6_0-injected-bundles-debuginfo-2.52.4-160000.1.1 * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-160000.1.1 * libwebkit2gtk-4_1-0-2.52.4-160000.1.1 * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.4-160000.1.1 * webkit-jsc-4.1-debuginfo-2.52.4-160000.1.1 * libwebkitgtk-6_0-4-2.52.4-160000.1.1 * webkit-jsc-6.0-debuginfo-2.52.4-160000.1.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-160000.1.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-160000.1.1 * webkit2gtk4-minibrowser-2.52.4-160000.1.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-160000.1.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-160000.1.1 * webkit2gtk3-minibrowser-debuginfo-2.52.4-160000.1.1 * webkit2gtk3-minibrowser-2.52.4-160000.1.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-160000.1.1 * typelib-1_0-JavaScriptCore-6_0-2.52.4-160000.1.1 * webkit2gtk4-minibrowser-debuginfo-2.52.4-160000.1.1 * libjavascriptcoregtk-4_1-0-2.52.4-160000.1.1 * webkitgtk-6_0-injected-bundles-2.52.4-160000.1.1 * typelib-1_0-WebKit2-4_1-2.52.4-160000.1.1 * SUSE Linux Enterprise Server 16.0 (noarch) * WebKitGTK-6.0-lang-2.52.4-160000.1.1 * WebKitGTK-4.1-lang-2.52.4-160000.1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-28847.html * https://www.suse.com/security/cve/CVE-2026-28883.html * https://www.suse.com/security/cve/CVE-2026-28901.html * https://www.suse.com/security/cve/CVE-2026-28902.html * https://www.suse.com/security/cve/CVE-2026-28903.html * https://www.suse.com/security/cve/CVE-2026-28904.html * https://www.suse.com/security/cve/CVE-2026-28905.html * https://www.suse.com/security/cve/CVE-2026-28907.html * https://www.suse.com/security/cve/CVE-2026-28942.html * https://www.suse.com/security/cve/CVE-2026-28946.html * https://www.suse.com/security/cve/CVE-2026-28947.html * https://www.suse.com/security/cve/CVE-2026-28953.html * https://www.suse.com/security/cve/CVE-2026-28955.html * https://www.suse.com/security/cve/CVE-2026-28958.html * https://www.suse.com/security/cve/CVE-2026-43658.html * https://www.suse.com/security/cve/CVE-2026-43660.html * https://bugzilla.suse.com/show_bug.cgi?id=1267506 * https://bugzilla.suse.com/show_bug.cgi?id=1267507 * https://bugzilla.suse.com/show_bug.cgi?id=1267508 * https://bugzilla.suse.com/show_bug.cgi?id=1267509 * https://bugzilla.suse.com/show_bug.cgi?id=1267510 * https://bugzilla.suse.com/show_bug.cgi?id=1267511 * https://bugzilla.suse.com/show_bug.cgi?id=1267512 * https://bugzilla.suse.com/show_bug.cgi?id=1267513 * https://bugzilla.suse.com/show_bug.cgi?id=1267514 * https://bugzilla.suse.com/show_bug.cgi?id=1267515 * https://bugzilla.suse.com/show_bug.cgi?id=1267516 * https://bugzilla.suse.com/show_bug.cgi?id=1267517 * https://bugzilla.suse.com/show_bug.cgi?id=1267518 * https://bugzilla.suse.com/show_bug.cgi?id=1267519 * https://bugzilla.suse.com/show_bug.cgi?id=1267520 * https://bugzilla.suse.com/show_bug.cgi?id=1267521 . A vital update for webkit2gtk3 addresses 16 issues, mitigating risks of process crashes and enhancing user security.. SUSE security update, webkit2gtk3 vulnerabilities, important security fix. . Severity: Important. LinuxSecurity.com Team
Jun 23, 2026
•Important
SuSE
100
security advisorycode executionimportantopenSUSE Webkit2gtk3 Important Heap Buffer Overflow Vuln 2026-2376-1
An update that solves 16 vulnerabilities and has one security fix can now be installed.. # Security update for webkit2gtk3 Announcement ID: SUSE-SU-2026:2376-1 Release Date: 2026-06-11T16:07:26Z Rating: important References: * bsc#1264745 * bsc#1267506 * bsc#1267507 * bsc#1267508 * bsc#1267509 * bsc#1267510 * bsc#1267511 * bsc#1267512 * bsc#1267513 * bsc#1267514 * bsc#1267515 * bsc#1267516 * bsc#1267517 * bsc#1267518 * bsc#1267519 * bsc#1267520 * bsc#1267521 Cross-References: * CVE-2026-28847 * CVE-2026-28883 * CVE-2026-28901 * CVE-2026-28902 * CVE-2026-28903 * CVE-2026-28904 * CVE-2026-28905 * CVE-2026-28907 * CVE-2026-28942 * CVE-2026-28946 * CVE-2026-28947 * CVE-2026-28953 * CVE-2026-28955 * CVE-2026-28958 * CVE-2026-43658 * CVE-2026-43660 CVSS scores: * CVE-2026-28847 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28847 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28847 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28883 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28883 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28883 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28901 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28901 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28901 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-28902 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28902 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28902 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28903 ( SUSE ): 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28903 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28904 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28904 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28905 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28905 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28905 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-28907 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-28907 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-28942 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28942 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28942 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28946 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28946 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28946 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28947 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-28947 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28947 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28953 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28953 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-28953 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-28955 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N *CVE-2026-28955 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-28955 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-28958 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-28958 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-28958 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-43658 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-43658 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-43658 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-43660 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2026-43660 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP7 * Desktop Applications Module 15-SP7 * Development Tools Module 15-SP7 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves 16 vulnerabilities and has one security fix can now be installed. ## Description: This update for webkit2gtk3 fixes the following issues Update to version 2.52.4: Security fixes: * CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code execution due to a heap buffer overflow (bsc#1267506). * CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after- free issue (bsc#1267507). * CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267508). * CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267509). * CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267510). * CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267511). * CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267512). * CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to improper input validation (bsc#1267513). * CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free (bsc#1267514). * CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267515). * CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267516). * CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267517). * CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267518). * CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519). * CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due to improper memory handling (bsc#1267520). * CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to issues with logic (bsc#1267521). Other fixes: * Add patch tofix a crash on evolution (bsc#1264745). Changes: * Add support for half-width fonts. * Improve content filter compilation by avoiding file copies. * Improve handling of out of disk space conditions when the NetworkProcess tried to write data in caches. * Improve how the CMake build system checks whether libatomic is required. * Fix painting scrollbars when their width changes. * Fix playback of certain YouTube videos with low frame rates. * Fix webkit://gpu not working in systems where neither libGL.so.1 nor libOpenGL.so.0 are available. * Fix the build with librice 0.4 or newer when the GStreamer WebRTC backend is enabled at build configuration time. * Fix the build with USE_GSTREAMER_WEBRTC=OFF. * Fix the build with USE_GBM=OFF. * Fix several crashes and rendering issues. * Add support for the "scrollbar-color" CSS property. * Fix some emoji glyphs being rendered as missing glyph boxes. * Fix JavaScriptCore crashes on architectures other than x86_64. * Fix the build on s390x. * Changes in version 2.52.2: * Improve handling of real-time threads. * Fix scrollbar rendering glitches visible in some GPU configurations. * Fix V4L2 hardware accelerated media codecs now working due to overly restrictive sandbox device access rules. * Fix leak of bitmap images in webkit_favicon_database_get_favicon_finish(). * Fix the build with USE_GTK4=OFF. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-2376=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-2376=1 * Desktop Applications Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-2376=1 * Development Tools Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-2376=1 * SUSE LinuxEnterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2376=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2376=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150600.12.68.1 * webkit2gtk4-devel-2.52.4-150600.12.68.1 * webkit-jsc-4.1-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk3-minibrowser-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-WebKit-6_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk3-minibrowser-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_1-2.52.4-150600.12.68.1 * webkit-jsc-4.1-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-devel-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-minibrowser-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-6_0-2.52.4-150600.12.68.1 * webkit2gtk4-minibrowser-2.52.4-150600.12.68.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * webkit-jsc-6.0-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-minibrowser-debuginfo-2.52.4-150600.12.68.1 * webkit-jsc-4-2.52.4-150600.12.68.1 * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk4-minibrowser-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-2.52.4-150600.12.68.1 * webkit-jsc-4-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150600.12.68.1 *libjavascriptcoregtk-4_1-0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-6_0-1-2.52.4-150600.12.68.1 * webkit2gtk3-devel-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150600.12.68.1 * webkit2gtk4-debugsource-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-debugsource-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-2.52.4-150600.12.68.1 * webkit-jsc-6.0-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-2.52.4-150600.12.68.1 * webkit2gtk3-debugsource-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 * openSUSE Leap 15.6 (noarch) * WebKitGTK-4.1-lang-2.52.4-150600.12.68.1 * WebKitGTK-4.0-lang-2.52.4-150600.12.68.1 * WebKitGTK-6.0-lang-2.52.4-150600.12.68.1 * openSUSE Leap 15.6 (x86_64) * libwebkit2gtk-4_1-0-32bit-debuginfo-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-32bit-debuginfo-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-32bit-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-32bit-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-32bit-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-32bit-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-32bit-debuginfo-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.52.4-150600.12.68.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libjavascriptcoregtk-4_0-18-64bit-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-64bit-debuginfo-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-64bit-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-64bit-debuginfo-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-64bit-debuginfo-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-64bit-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-64bit-2.52.4-150600.12.68.1 *libwebkit2gtk-4_0-37-64bit-2.52.4-150600.12.68.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk4-debugsource-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-debugsource-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-devel-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * libjavascriptcoregtk-6_0-1-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150600.12.68.1 * Basesystem Module 15-SP7 (noarch) * WebKitGTK-4.0-lang-2.52.4-150600.12.68.1 * WebKitGTK-6.0-lang-2.52.4-150600.12.68.1 * Desktop Applications Module 15-SP7 (noarch) * WebKitGTK-4.1-lang-2.52.4-150600.12.68.1 * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150600.12.68.1 * webkit2gtk3-debugsource-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_1-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-2.52.4-150600.12.68.1 * webkit2gtk3-devel-2.52.4-150600.12.68.1 *libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 * Development Tools Module 15-SP7 (aarch64 ppc64le s390x x86_64) * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.4-150600.12.68.1 * webkit2gtk4-debugsource-2.52.4-150600.12.68.1 * webkit2gtk4-devel-2.52.4-150600.12.68.1 * typelib-1_0-WebKit-6_0-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-6_0-2.52.4-150600.12.68.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * WebKitGTK-4.1-lang-2.52.4-150600.12.68.1 * WebKitGTK-4.0-lang-2.52.4-150600.12.68.1 * WebKitGTK-6.0-lang-2.52.4-150600.12.68.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150600.12.68.1 * webkit2gtk4-devel-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-WebKit-6_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-devel-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_1-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-6_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-2.52.4-150600.12.68.1 * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-6_0-1-2.52.4-150600.12.68.1 * webkit2gtk3-devel-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150600.12.68.1 *libwebkit2gtk-4_0-37-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk4-debugsource-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-debugsource-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-2.52.4-150600.12.68.1 * webkit2gtk3-debugsource-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * WebKitGTK-4.1-lang-2.52.4-150600.12.68.1 * WebKitGTK-4.0-lang-2.52.4-150600.12.68.1 * WebKitGTK-6.0-lang-2.52.4-150600.12.68.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * typelib-1_0-WebKit2WebExtension-4_1-2.52.4-150600.12.68.1 * webkit2gtk4-devel-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-WebKit-6_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_0-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-devel-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_1-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-6_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-6_0-1-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-2.52.4-150600.12.68.1 * typelib-1_0-WebKitWebProcessExtension-6_0-2.52.4-150600.12.68.1 * libwebkit2gtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-2.52.4-150600.12.68.1 * webkit2gtk-4_0-injected-bundles-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-2.52.4-150600.12.68.1 * webkit2gtk-4_1-injected-bundles-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-2.52.4-150600.12.68.1 *libjavascriptcoregtk-6_0-1-2.52.4-150600.12.68.1 * webkit2gtk3-devel-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2WebExtension-4_0-2.52.4-150600.12.68.1 * libwebkit2gtk-4_0-37-debuginfo-2.52.4-150600.12.68.1 * webkit2gtk4-debugsource-2.52.4-150600.12.68.1 * webkit2gtk3-soup2-debugsource-2.52.4-150600.12.68.1 * typelib-1_0-JavaScriptCore-4_1-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_0-18-2.52.4-150600.12.68.1 * libwebkitgtk-6_0-4-2.52.4-150600.12.68.1 * webkit2gtk3-debugsource-2.52.4-150600.12.68.1 * webkitgtk-6_0-injected-bundles-debuginfo-2.52.4-150600.12.68.1 * typelib-1_0-WebKit2-4_0-2.52.4-150600.12.68.1 * libjavascriptcoregtk-4_1-0-debuginfo-2.52.4-150600.12.68.1 ## References: * https://www.suse.com/security/cve/CVE-2026-28847.html * https://www.suse.com/security/cve/CVE-2026-28883.html * https://www.suse.com/security/cve/CVE-2026-28901.html * https://www.suse.com/security/cve/CVE-2026-28902.html * https://www.suse.com/security/cve/CVE-2026-28903.html * https://www.suse.com/security/cve/CVE-2026-28904.html * https://www.suse.com/security/cve/CVE-2026-28905.html * https://www.suse.com/security/cve/CVE-2026-28907.html * https://www.suse.com/security/cve/CVE-2026-28942.html * https://www.suse.com/security/cve/CVE-2026-28946.html * https://www.suse.com/security/cve/CVE-2026-28947.html * https://www.suse.com/security/cve/CVE-2026-28953.html * https://www.suse.com/security/cve/CVE-2026-28955.html * https://www.suse.com/security/cve/CVE-2026-28958.html * https://www.suse.com/security/cve/CVE-2026-43658.html * https://www.suse.com/security/cve/CVE-2026-43660.html * https://bugzilla.suse.com/show_bug.cgi?id=1264745 * https://bugzilla.suse.com/show_bug.cgi?id=1267506 * https://bugzilla.suse.com/show_bug.cgi?id=1267507 * https://bugzilla.suse.com/show_bug.cgi?id=1267508 * https://bugzilla.suse.com/show_bug.cgi?id=1267509 * https://bugzilla.suse.com/show_bug.cgi?id=1267510 *https://bugzilla.suse.com/show_bug.cgi?id=1267511 * https://bugzilla.suse.com/show_bug.cgi?id=1267512 * https://bugzilla.suse.com/show_bug.cgi?id=1267513 * https://bugzilla.suse.com/show_bug.cgi?id=1267514 * https://bugzilla.suse.com/show_bug.cgi?id=1267515 * https://bugzilla.suse.com/show_bug.cgi?id=1267516 * https://bugzilla.suse.com/show_bug.cgi?id=1267517 * https://bugzilla.suse.com/show_bug.cgi?id=1267518 * https://bugzilla.suse.com/show_bug.cgi?id=1267519 * https://bugzilla.suse.com/show_bug.cgi?id=1267520 * https://bugzilla.suse.com/show_bug.cgi?id=1267521 . Critical security update for SUSE webkit2gtk3; fixes 16 issues, ensuring safe web interaction and data protection.. SUSE Update Import Vulnerability Webkit2gtk3. . Severity: Important. LinuxSecurity.com Team
Jun 11, 2026
•Important
SuSE
202
security advisorymoderateDoSopenSUSE Leap 16.0 polkit Moderate OOM Vulnerability CVE-2026-4897
An update that solves one vulnerability and has one bug fix can now be installed.. openSUSE security update: security update for polkit ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20925-1 Rating: moderate References: * bsc#1260859 Cross-References: * CVE-2026-4897 CVSS scores: * CVE-2026-4897 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-4897 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves one vulnerability and has one bug fix can now be installed. Description: This update for polkit fixes the following issue: - CVE-2026-4897: Fixed possible OOM condition via specially crafted input to `polkit-agent-helper-1` (bsc#1260859). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-907=1 Package List: - openSUSE Leap 16.0: libpolkit-agent-1-0-123-160000.3.1 libpolkit-gobject-1-0-123-160000.3.1 pkexec-123-160000.3.1 polkit-123-160000.3.1 polkit-devel-123-160000.3.1 polkit-doc-123-160000.3.1 typelib-1_0-Polkit-1_0-123-160000.3.1 References: * https://www.suse.com/security/cve/CVE-2026-4897.html . Update for polkit on openSUSE addresses a memory issue, critical for system performance and security. Install now!. polkit update, openSUSE security, memory issue fix, DoS mitigation, application protection. . Severity: moderate. LinuxSecurity.com Team
Jun 09, 2026
•moderate
OpenSUSE
89
security advisoryfedoralibpngFedora 44 Libpng Medium Use-After-Free Memory Bug 2026-67c1138ed2
updated to 1.6.58 1.6.58 is released with a fix for a simple correctness bug (not a security issue) this time: png_get_PLTE() returns stale palette data when either gamma correction or alpha-compositing is the only transform applied. Like the issues addressed in the previous release, this bug was a regression introduced in the. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-67c1138ed2 2026-05-29 01:10:57.991217+00:00 -------------------------------------------------------------------------------- Name : libpng Product : Fedora 44 Version : 1.6.58 Release : 1.fc44 URL : http://www.libpng.org/pub/png/ Summary : A library of functions for manipulating PNG image format files Description : The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. PNG is a bit-mapped graphics format similar to the GIF format. PNG was created to replace the GIF format, since GIF uses a patented data compression algorithm. Libpng should be installed if you need to manipulate PNG format image files. -------------------------------------------------------------------------------- Update Information: updated to 1.6.58 1.6.58 is released with a fix for a simple correctness bug (not a security issue) this time: png_get_PLTE() returns stale palette data when either gamma correction or alpha-compositing is the only transform applied. Like the issues addressed in the previous release, this bug was a regression introduced in the fix for CVE-2026-33416 in 1.6.56. 1.6.57 is released with fixes for the following security vulnerability: CVE-2026-34757 (medium severity): Use-after-free memory bug in the chunk setter API. The hIST variant has existed since version 1.0.9, but the PLTE and tRNS ones are regressions introduced in the fix for CVE-2026-33416 in 1.6.56(oops). -------------------------------------------------------------------------------- ChangeLog: * Thu May 21 2026 Michal Hlavinka - 2:1.6.58-1 - updated to 1.6.58 (#2456815) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2460625 - CVE-2026-22020 libpng: OpenJDK: Update LibPNG (Oracle CPU 2026-04) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2460625 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-67c1138ed2' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
May 29, 2026
•Medium
Fedora
100
security advisorymoderateSuSESUSE Linux Micro 6.1 helm Moderate Memory Strategy Challenges 2026-21636-2
An update that solves two vulnerabilities and contains one feature can now be installed.. # Security update for helm Announcement ID: SUSE-SU-2026:21635-1 Release Date: 2026-05-12T10:25:24Z Rating: moderate References: * bsc#1248093 * bsc#1261938 * jsc#PED-15794 Cross-References: * CVE-2025-55199 * CVE-2026-35206 CVSS scores: * CVE-2025-55199 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2025-55199 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-55199 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-35206 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-35206 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L * CVE-2026-35206 ( NVD ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-35206 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Affected Products: * SUSE Linux Micro 6.1 An update that solves two vulnerabilities and contains one feature can now be installed. ## Description: This update for helm fixes the following issues Security issues: * CVE-2025-55199: crafted JSON Schema can lead to out of memory (OOM) termination (bsc#1248093). * CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938). Non security issue: * Update to version 3.20.2 * Fix packages for %suse_version bump (jsc#PED-15794). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.1 zypper in -t patchSUSE-SLE-Micro-6.1-525=1 ## Package List: * SUSE Linux Micro 6.1 (aarch64 ppc64le s390x x86_64) * helm-3.20.2-slfo.1.1_1.1 * helm-debuginfo-3.20.2-slfo.1.1_1.1 * SUSE Linux Micro 6.1 (noarch) * helm-bash-completion-3.20.2-slfo.1.1_1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-55199.html * https://www.suse.com/security/cve/CVE-2026-35206.html * https://bugzilla.suse.com/show_bug.cgi?id=1248093 * https://bugzilla.suse.com/show_bug.cgi?id=1261938 * https://jira.suse.com/browse/PED-15794 . SUSE Linux Micro 6.1 helm update tackles memory and directory issues with moderate severity patches. Updates advised.. SUSE Linux Micro, helm, security update, vulnerabilities, memory issue. . LinuxSecurity.com Team
May 15, 2026
SuSE
172
security advisorydenial of serviceUbuntuUbuntu 26.04 LTS OpenJPEG Important Memory Issue CVE-2026-6192
OpenJPEG could be made to crash or run programs when encoding image files.. ========================================================================== Ubuntu Security Notice USN-8252-1 May 07, 2026 openjpeg2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: OpenJPEG could be made to crash or run programs when encoding image files. Software Description: - openjpeg2: JPEG 2000 image compression/decompression library Details: It was discovered that OpenJPEG did not properly handle memory when encoding image files. An attacker could use this issue to cause OpenJPEG to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libopenjp2-7 2.5.4-1ubuntu0.1 Ubuntu 25.10 libopenjp2-7 2.5.3-2.1ubuntu0.1 Ubuntu 24.04 LTS libopenjp2-7 2.5.0-2ubuntu0.5 Ubuntu 22.04 LTS libopenjp2-7 2.4.0-6ubuntu0.5 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8252-1 CVE-2026-6192 Package Information: https://launchpad.net/ubuntu/+source/openjpeg2/2.5.4-1ubuntu0.1 https://launchpad.net/ubuntu/+source/openjpeg2/2.5.3-2.1ubuntu0.1 https://launchpad.net/ubuntu/+source/openjpeg2/2.5.0-2ubuntu0.5 https://launchpad.net/ubuntu/+source/openjpeg2/2.4.0-6ubuntu0.5 . OpenJPEG on Ubuntu has a critical memory handling issue allowing DoS or code execution. Update your systems promptly.. Ubuntu Security Notice OpenJPEG memory issue DoS update. . Severity: Important. LinuxSecurity.com Team
May 07, 2026
•Important
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!