CLSA-2026-1782217586
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1782217586.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782217586
- Upstream
CVE (16)
- CVE-2026-28847
- CVE-2026-28883
- CVE-2026-28901
- CVE-2026-28902
- CVE-2026-28903
- CVE-2026-28904
- CVE-2026-28905
- CVE-2026-28907
- CVE-2026-28942
- CVE-2026-28946
- CVE-2026-28947
- CVE-2026-28953
- CVE-2026-28955
- CVE-2026-28958
- CVE-2026-43658
- CVE-2026-43660
- Published
- 2026-07-20T09:05:48Z
- Modified
- 2026-10-26T09:30:22Z
- Summary
- webkit2gtk3: Fix of 17 CVEs
- Details
-
- Rebase to webkitgtk 2.52.4 to address WebKitGTK security advisory WSA-2026-0003 (16 CVEs).
- Refresh libsoup2.patch for 2.52.4 library version triplet bumps (WEBKIT 21/8/21, JAVASCRIPTCORE 10/12/10 on API 4.1; WEBKIT 20/8/16, JAVASCRIPTCORE 8/12/7 on API 6.0).
- Drop aarch64-build.patch — the upstream cherry-pick (Apple fix for WebKit bug 306638) is included in 2.52.4.
- Add fix-system-malloc-llint-extractor.patch (upstream cherry-pick 314364@main, bugs.webkit.org/show_bug.cgi?id=316083) to gate bmalloc_CopyHeaders in LLIntSettingsExtractor/LLIntOffsetsExtractor dependencies on (NOT USE_SYSTEM_MALLOC). Without it, CMake configure fails on aarch64 because USE_64KB_PAGE_BLOCK=ON forces USE_SYSTEM_MALLOC=ON, which prevents the bmalloc subdirectory from being added and the bmalloc_CopyHeaders target from being created.
- CVEs resolved by this rebase (WSA-2026-0003): CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, CVE-2026-43660
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782217586.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-43214
- https://nvd.nist.gov/vuln/detail/CVE-2026-28847
- https://nvd.nist.gov/vuln/detail/CVE-2026-28883
- https://nvd.nist.gov/vuln/detail/CVE-2026-28901
- https://nvd.nist.gov/vuln/detail/CVE-2026-28902
- https://nvd.nist.gov/vuln/detail/CVE-2026-28903
- https://nvd.nist.gov/vuln/detail/CVE-2026-28904
- https://nvd.nist.gov/vuln/detail/CVE-2026-28905
- https://nvd.nist.gov/vuln/detail/CVE-2026-28907
- https://nvd.nist.gov/vuln/detail/CVE-2026-28942
- https://nvd.nist.gov/vuln/detail/CVE-2026-28946
- https://nvd.nist.gov/vuln/detail/CVE-2026-28947
- https://nvd.nist.gov/vuln/detail/CVE-2026-28953
- https://nvd.nist.gov/vuln/detail/CVE-2026-28955
- https://nvd.nist.gov/vuln/detail/CVE-2026-28958
- https://nvd.nist.gov/vuln/detail/CVE-2026-43658
- https://nvd.nist.gov/vuln/detail/CVE-2026-43660
Affected packages
TuxCare:AlmaLinux:9.2 / webkit2gtk3
Package
- Name
- webkit2gtk3
- Purl
- pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / webkit2gtk3-devel
Package
- Name
- webkit2gtk3-devel
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / webkit2gtk3-jsc
Package
- Name
- webkit2gtk3-jsc
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2