CLSA-2026-1782808694
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1782808694.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782808694
- Upstream
CVE (4)
- CVE-2025-46299
- CVE-2026-20664
- CVE-2026-28857
- CVE-2026-28859
- Published
- 2026-06-30T08:38:40Z
- Modified
- 2026-10-26T09:31:14Z
- Summary
- webkit2gtk3: Fix of 4 CVEs
- Details
-
- Rebase to webkitgtk 2.52.4. CVE-2025-46299 (uninitialized-memory disclosure via maliciously crafted web content; WebKit bug 299518, fixed upstream in 2.52.0 / WSA-2026-0001) has no isolatable backport -- the bug is security-restricted and the fix ships only within the 2.52.x series. Move webkit2gtk3 onto the 2.52.x security baseline, matching RHEL 9.6 (RHSA-2026:11329) and the almalinux9.2esu sibling.
- CVEs still open on this branch that are resolved by this rebase: CVE-2025-46299, CVE-2026-20664, CVE-2026-28857, CVE-2026-28859.
- Drop the CVE-2026-* backport patches (Patch100..Patch117); all are fixed upstream in 2.52.x and now provided by the 2.52.4 tarball.
- Adopt the 2.52.x packaging/compat patch set (libsoup2, glib-2-68, icu-67, g-ir-scanner-nonfatal, fix-system-malloc-llint-extractor, and the compiler-neutral fix-* source fixes). Build natively with the AlmaLinux 9.6 clang + cmake 3.26.5 toolchain; no gcc-toolset-12 or linked cmake required.
- Exclude i686: WebKit 2.52 fails CMake atomic-variable detection on 32-bit x86 (matches almalinux9.2esu).
- References
Affected packages
TuxCare:AlmaLinux:9.6 / webkit2gtk3
Package
- Name
- webkit2gtk3
- Purl
- pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.6
TuxCare:AlmaLinux:9.6 / webkit2gtk3-devel
Package
- Name
- webkit2gtk3-devel
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.6
TuxCare:AlmaLinux:9.6 / webkit2gtk3-jsc
Package
- Name
- webkit2gtk3-jsc
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.6