Alberto Garcia pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
40a26480 by Alberto Garcia at 2026-07-23T10:40:33+02:00
webkit2gtk / wpewebkit upstream advisory WSA-2026-0003
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -55129,11 +55129,25 @@ CVE-2026-43666 (An out-of-bounds write issue was
addressed with improved bounds
CVE-2026-43661 (A buffer overflow issue was addressed with improved memory
handling. T ...)
NOT-FOR-US: Apple
CVE-2026-43660 (A validation issue was addressed with improved logic. This
issue is fi ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-43659 (A race condition was addressed with additional validation.
This issue ...)
NOT-FOR-US: Apple
CVE-2026-43658 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-43656 (An out-of-bounds write issue was addressed with improved input
validat ...)
NOT-FOR-US: Apple
CVE-2026-43655 (An out-of-bounds read was addressed with improved bounds
checking. Thi ...)
@@ -55295,31 +55309,73 @@ CVE-2026-28961 (This issue was addressed with
improved checks. This issue is fix
CVE-2026-28959 (A buffer overflow was addressed with improved bounds checking.
This is ...)
NOT-FOR-US: Apple
CVE-2026-28958 (This issue was addressed with improved data protection. This
issue is ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28957 (An issue with app access to camera metadata was addressed with
improve ...)
NOT-FOR-US: Apple
CVE-2026-28956 (A memory corruption issue was addressed with improved input
validation ...)
NOT-FOR-US: Apple
CVE-2026-28955 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28954 (A file quarantine bypass was addressed with additional checks.
This is ...)
NOT-FOR-US: Apple
CVE-2026-28953 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28952 (An integer overflow was addressed with improved input
validation. This ...)
NOT-FOR-US: Apple
CVE-2026-28951 (An authorization issue was addressed with improved state
management. T ...)
NOT-FOR-US: Apple
CVE-2026-28947 (A use-after-free issue was addressed with improved memory
management. ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28946 (A use-after-free issue was addressed with improved memory
management. ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28944 (The issue was addressed with improved memory handling. This
issue is f ...)
NOT-FOR-US: Apple
CVE-2026-28943 (A logging issue was addressed with improved data redaction.
This issue ...)
NOT-FOR-US: Apple
CVE-2026-28942 (A use-after-free issue was addressed with improved memory
management. ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28941 (The issue was addressed with improved checks. This issue is
fixed in i ...)
NOT-FOR-US: Apple
CVE-2026-28940 (The issue was addressed with improved memory handling. This
issue is f ...)
@@ -55357,23 +55413,72 @@ CVE-2026-28910 (This issue was addressed with
improved permissions checking. Thi
CVE-2026-28908 (A denial of service issue was addressed by removing the
vulnerable cod ...)
NOT-FOR-US: Apple
CVE-2026-28907 (The issue was addressed with improved input validation. This
issue is ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28906 (This issue was addressed through improved state management.
This issue ...)
NOT-FOR-US: Apple
CVE-2026-28905 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28904 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28903 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28902 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28901 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28897 (A buffer overflow was addressed with improved input
validation. This i ...)
NOT-FOR-US: Apple
CVE-2026-28883 (A use-after-free issue was addressed with improved memory
management. ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28873 (This issue was addressed with additional entitlement checks.
This issu ...)
NOT-FOR-US: Apple
CVE-2026-28872 (A resource exhaustion issue was addressed with improved input
validati ...)
@@ -55383,7 +55488,14 @@ CVE-2026-28860 (The issue was addressed with improved
input validation. This iss
CVE-2026-28848 (A buffer overflow was addressed with improved bounds checking.
This is ...)
NOT-FOR-US: Apple
CVE-2026-28847 (The issue was addressed with improved memory handling. This
issue is f ...)
- NOT-FOR-US: Apple
+ - webkit2gtk 2.52.4-1
+ [bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+ [bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+ - wpewebkit 2.52.4-1
+ [trixie] - wpewebkit <ignored> (wpewebkit not covered by security
support in Trixie)
+ [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security
support in Bookworm)
+ [bullseye] - wpewebkit <end-of-life> (see #1035997)
+ NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
CVE-2026-28846 (A buffer overflow was addressed with improved bounds checking.
This is ...)
NOT-FOR-US: Apple
CVE-2026-28840 (A permissions issue was addressed with additional
restrictions. This i ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/40a26480b3f5153fe18b448991196eba38ed7627
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/40a26480b3f5153fe18b448991196eba38ed7627
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
