Security update for webkit2gtk3
| Announcement ID: | SUSE-SU-2026:1364-1 |
|---|---|
| Release Date: | 2026-04-15T14:28:23Z |
| Rating: | important |
| References: | |
| Cross-References: |
|
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 25 vulnerabilities can now be installed.
Description:
This update for webkit2gtk3 fixes the following issues:
Update to version 2.52.1.
Security issues fixed:
- CVE-2023-43010: processing maliciously crafted web content may lead to memory corruption (bsc#1259950).
- CVE-2025-31223: processing maliciously crafted web content may lead to memory corruption (bsc#1259949).
- CVE-2025-31277: processing maliciously crafted web content may lead to memory corruption (bsc#1259948).
- CVE-2025-43213: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259947).
- CVE-2025-43214: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259946).
- CVE-2025-43433: processing maliciously crafted web content may lead to memory corruption (bsc#1259945).
- CVE-2025-43438: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259944).
- CVE-2025-43441: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259943).
- CVE-2025-43457: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259942).
- CVE-2025-43511: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259941).
- CVE-2025-46299: processing maliciously crafted web content may disclose internal states of an app (bsc#1259940).
- CVE-2026-20608: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259939).
- CVE-2026-20635: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259938).
- CVE-2026-20636: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259937).
- CVE-2026-20643: processing maliciously crafted web content may bypass Same Origin Policy (bsc#1261172).
- CVE-2026-20644: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1259936).
- CVE-2026-20652: a remote attacker may be able to cause a denial-of-service (bsc#1259935).
- CVE-2026-20664: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1261173).
- CVE-2026-20665: processing maliciously crafted web content may prevent Content Security Policy from being enforced (bsc#1261174).
- CVE-2026-20676: a website may be able to track users through web extensions (bsc#1259934).
- CVE-2026-20691: a maliciously crafted webpage may be able to fingerprint the user (bsc#1261175).
- CVE-2026-28857: processing maliciously crafted web content may lead to an unexpected process crash (bsc#1261176).
- CVE-2026-28859: a malicious website may be able to process restricted web content outside the sandbox (bsc#1261177).
- CVE-2026-28861: a malicious website may be able to access script message handlers intended for other origins (bsc#1261178).
- CVE-2026-28871: visiting a maliciously crafted website may lead to a cross-site scripting attack (bsc#1261179).
Other updates and bugfixes:
- Make scrolling with touch input smoother for small movements.
- Fix estimated load progress of downloads when Content-Length value is wrong.
- Ensure that "scrollend" events are correctly emitted after scroll animations.
- Reduce the amount of useless MPRIS notifications produced by MediaSession when the information about media being played is incomplete.
- Support turning off USE_GSTREAMER to configure the build with all multimedia features disabled.
- Add Sysprof marks for mouse events.
- Fix MediaSession icon for iheart.com not being displayed.
- Fix the build with USE_GSTREAMER_GL disabled.
- Fix the build with librice version 0.3.0 or newer.
- Fix several crashes and rendering issues.
- Translation updates: Georgian.
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
openSUSE Leap 15.6
zypper in -t patch SUSE-2026-1364=1 openSUSE-SLE-15.6-2026-1364=1 -
Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1364=1 -
Desktop Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-1364=1 -
Development Tools Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-1364=1 -
SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1364=1 -
SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1364=1
Package List:
-
openSUSE Leap 15.6 (noarch)
- WebKitGTK-4.0-lang-2.52.1-150600.12.63.1
- WebKitGTK-6.0-lang-2.52.1-150600.12.63.1
- WebKitGTK-4.1-lang-2.52.1-150600.12.63.1
-
openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
- webkit2gtk-4_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- webkit2gtk4-minibrowser-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-debuginfo-2.52.1-150600.12.63.1
- webkit-jsc-6.0-debuginfo-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-minibrowser-2.52.1-150600.12.63.1
- webkit2gtk4-devel-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-2.52.1-150600.12.63.1
- webkit2gtk-4_0-injected-bundles-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-devel-2.52.1-150600.12.63.1
- webkit2gtk4-debugsource-2.52.1-150600.12.63.1
- webkit-jsc-4-2.52.1-150600.12.63.1
- webkit-jsc-6.0-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-minibrowser-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-debugsource-2.52.1-150600.12.63.1
- webkit2gtk3-devel-2.52.1-150600.12.63.1
- webkit2gtk4-minibrowser-2.52.1-150600.12.63.1
- webkit-jsc-4.1-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_1-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
- webkit-jsc-4-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit-6_0-2.52.1-150600.12.63.1
- typelib-1_0-WebKitWebProcessExtension-6_0-2.52.1-150600.12.63.1
- webkit-jsc-4.1-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-6_0-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_1-2.52.1-150600.12.63.1
- webkit2gtk3-minibrowser-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_0-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_0-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-4_1-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-4_0-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-debuginfo-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-2.52.1-150600.12.63.1
- webkit2gtk3-debugsource-2.52.1-150600.12.63.1
- webkit2gtk3-minibrowser-debuginfo-2.52.1-150600.12.63.1
-
openSUSE Leap 15.6 (x86_64)
- libwebkit2gtk-4_1-0-32bit-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-32bit-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-32bit-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-32bit-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-32bit-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-32bit-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-32bit-debuginfo-2.52.1-150600.12.63.1
-
openSUSE Leap 15.6 (aarch64_ilp32)
- libwebkit2gtk-4_0-37-64bit-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-64bit-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-64bit-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-64bit-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-64bit-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-64bit-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-64bit-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-64bit-debuginfo-2.52.1-150600.12.63.1
-
Basesystem Module 15-SP7 (noarch)
- WebKitGTK-4.0-lang-2.52.1-150600.12.63.1
- WebKitGTK-6.0-lang-2.52.1-150600.12.63.1
-
Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
- webkit2gtk3-soup2-devel-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-2.52.1-150600.12.63.1
- webkit2gtk-4_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-debuginfo-2.52.1-150600.12.63.1
- webkit2gtk4-debugsource-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-4_0-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-debuginfo-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-debugsource-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-debuginfo-2.52.1-150600.12.63.1
- webkit2gtk-4_0-injected-bundles-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_0-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_0-2.52.1-150600.12.63.1
-
Desktop Applications Module 15-SP7 (noarch)
- WebKitGTK-4.1-lang-2.52.1-150600.12.63.1
-
Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
- typelib-1_0-JavaScriptCore-4_1-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_1-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-2.52.1-150600.12.63.1
- webkit2gtk3-debugsource-2.52.1-150600.12.63.1
- webkit2gtk3-devel-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_1-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
-
Development Tools Module 15-SP7 (aarch64 ppc64le s390x x86_64)
- typelib-1_0-WebKit-6_0-2.52.1-150600.12.63.1
- webkit2gtk4-debugsource-2.52.1-150600.12.63.1
- typelib-1_0-WebKitWebProcessExtension-6_0-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-6_0-2.52.1-150600.12.63.1
- webkit2gtk4-devel-2.52.1-150600.12.63.1
-
SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
- WebKitGTK-4.0-lang-2.52.1-150600.12.63.1
- WebKitGTK-6.0-lang-2.52.1-150600.12.63.1
- WebKitGTK-4.1-lang-2.52.1-150600.12.63.1
-
SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
- webkit2gtk-4_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-debuginfo-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-2.52.1-150600.12.63.1
- webkit2gtk4-devel-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-2.52.1-150600.12.63.1
- webkit2gtk-4_0-injected-bundles-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-devel-2.52.1-150600.12.63.1
- webkit2gtk4-debugsource-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-debugsource-2.52.1-150600.12.63.1
- webkit2gtk3-devel-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_1-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit-6_0-2.52.1-150600.12.63.1
- typelib-1_0-WebKitWebProcessExtension-6_0-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-6_0-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_1-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_0-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_0-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-4_1-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-4_0-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-debuginfo-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-2.52.1-150600.12.63.1
- webkit2gtk3-debugsource-2.52.1-150600.12.63.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
- WebKitGTK-4.0-lang-2.52.1-150600.12.63.1
- WebKitGTK-6.0-lang-2.52.1-150600.12.63.1
- WebKitGTK-4.1-lang-2.52.1-150600.12.63.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
- webkit2gtk-4_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-debuginfo-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-2.52.1-150600.12.63.1
- webkit2gtk4-devel-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-2.52.1-150600.12.63.1
- webkit2gtk-4_0-injected-bundles-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-devel-2.52.1-150600.12.63.1
- webkit2gtk4-debugsource-2.52.1-150600.12.63.1
- libwebkit2gtk-4_0-37-2.52.1-150600.12.63.1
- webkit2gtk3-soup2-debugsource-2.52.1-150600.12.63.1
- webkit2gtk3-devel-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_1-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit-6_0-2.52.1-150600.12.63.1
- typelib-1_0-WebKitWebProcessExtension-6_0-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-6_0-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_1-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2WebExtension-4_0-2.52.1-150600.12.63.1
- typelib-1_0-WebKit2-4_0-2.52.1-150600.12.63.1
- libwebkitgtk-6_0-4-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-4_1-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_0-18-2.52.1-150600.12.63.1
- libjavascriptcoregtk-4_1-0-debuginfo-2.52.1-150600.12.63.1
- typelib-1_0-JavaScriptCore-4_0-2.52.1-150600.12.63.1
- webkit2gtk-4_1-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libjavascriptcoregtk-6_0-1-debuginfo-2.52.1-150600.12.63.1
- webkitgtk-6_0-injected-bundles-debuginfo-2.52.1-150600.12.63.1
- libwebkit2gtk-4_1-0-2.52.1-150600.12.63.1
- webkit2gtk3-debugsource-2.52.1-150600.12.63.1
References:
- https://www.suse.com/security/cve/CVE-2023-43010.html
- https://www.suse.com/security/cve/CVE-2025-31223.html
- https://www.suse.com/security/cve/CVE-2025-31277.html
- https://www.suse.com/security/cve/CVE-2025-43213.html
- https://www.suse.com/security/cve/CVE-2025-43214.html
- https://www.suse.com/security/cve/CVE-2025-43433.html
- https://www.suse.com/security/cve/CVE-2025-43438.html
- https://www.suse.com/security/cve/CVE-2025-43441.html
- https://www.suse.com/security/cve/CVE-2025-43457.html
- https://www.suse.com/security/cve/CVE-2025-43511.html
- https://www.suse.com/security/cve/CVE-2025-46299.html
- https://www.suse.com/security/cve/CVE-2026-20608.html
- https://www.suse.com/security/cve/CVE-2026-20635.html
- https://www.suse.com/security/cve/CVE-2026-20636.html
- https://www.suse.com/security/cve/CVE-2026-20643.html
- https://www.suse.com/security/cve/CVE-2026-20644.html
- https://www.suse.com/security/cve/CVE-2026-20652.html
- https://www.suse.com/security/cve/CVE-2026-20664.html
- https://www.suse.com/security/cve/CVE-2026-20665.html
- https://www.suse.com/security/cve/CVE-2026-20676.html
- https://www.suse.com/security/cve/CVE-2026-20691.html
- https://www.suse.com/security/cve/CVE-2026-28857.html
- https://www.suse.com/security/cve/CVE-2026-28859.html
- https://www.suse.com/security/cve/CVE-2026-28861.html
- https://www.suse.com/security/cve/CVE-2026-28871.html
- https://bugzilla.suse.com/show_bug.cgi?id=1259934
- https://bugzilla.suse.com/show_bug.cgi?id=1259935
- https://bugzilla.suse.com/show_bug.cgi?id=1259936
- https://bugzilla.suse.com/show_bug.cgi?id=1259937
- https://bugzilla.suse.com/show_bug.cgi?id=1259938
- https://bugzilla.suse.com/show_bug.cgi?id=1259939
- https://bugzilla.suse.com/show_bug.cgi?id=1259940
- https://bugzilla.suse.com/show_bug.cgi?id=1259941
- https://bugzilla.suse.com/show_bug.cgi?id=1259942
- https://bugzilla.suse.com/show_bug.cgi?id=1259943
- https://bugzilla.suse.com/show_bug.cgi?id=1259944
- https://bugzilla.suse.com/show_bug.cgi?id=1259945
- https://bugzilla.suse.com/show_bug.cgi?id=1259946
- https://bugzilla.suse.com/show_bug.cgi?id=1259947
- https://bugzilla.suse.com/show_bug.cgi?id=1259948
- https://bugzilla.suse.com/show_bug.cgi?id=1259949
- https://bugzilla.suse.com/show_bug.cgi?id=1259950
- https://bugzilla.suse.com/show_bug.cgi?id=1261172
- https://bugzilla.suse.com/show_bug.cgi?id=1261173
- https://bugzilla.suse.com/show_bug.cgi?id=1261174
- https://bugzilla.suse.com/show_bug.cgi?id=1261175
- https://bugzilla.suse.com/show_bug.cgi?id=1261176
- https://bugzilla.suse.com/show_bug.cgi?id=1261177
- https://bugzilla.suse.com/show_bug.cgi?id=1261178
- https://bugzilla.suse.com/show_bug.cgi?id=1261179