CLSA-2026-1791208722
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791208722.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791208722
- Upstream
CVE (5)
- CVE-2026-10009
- CVE-2026-11663
- CVE-2026-5870
- CVE-2026-7920
- CVE-2026-7923
- Published
- 2026-10-06T15:17:05Z
- Modified
- 2026-10-26T09:43:58Z
- Summary
- webkit2gtk3: Fix of 9 CVEs
- Details
-
- CVE-2026-5870: prevent integer overflow in the pixel offset calculations of SkReadPixelsRec/SkWritePixelsRec by routing them through SkSafeMath
- CVE-2026-7920: stop getRPProgram() mutating the shared SkSL program, which raced with the Ganesh backend reading it and freed IR nodes under it
- CVE-2026-7923: fix the discard_stack guard in the SkSL raster pipeline builder so it no longer removes more stack entries than the op pushed
- CVE-2026-10009: bound the number of partial contours in SkPathWriter::assemble so the folded-triangle entry count can no longer overflow
- CVE-2026-11663: replace the single shared glyph-run builder on SkCanvas with a stack of builders, drop drawable serialization from SkCustomTypeface and restrict the tags deserialized from SkPictures
- All five are backports into the vendored Skia only; no public API or ABI of the package is touched.
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791208722.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-43211
- https://nvd.nist.gov/vuln/detail/CVE-2025-43227
- https://nvd.nist.gov/vuln/detail/CVE-2025-43240
- https://nvd.nist.gov/vuln/detail/CVE-2025-43265
- https://nvd.nist.gov/vuln/detail/CVE-2026-10009
- https://nvd.nist.gov/vuln/detail/CVE-2026-11663
- https://nvd.nist.gov/vuln/detail/CVE-2026-5870
- https://nvd.nist.gov/vuln/detail/CVE-2026-7920
- https://nvd.nist.gov/vuln/detail/CVE-2026-7923
Affected packages
TuxCare:AlmaLinux:9.2 / webkit2gtk3
Package
- Name
- webkit2gtk3
- Purl
- pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / webkit2gtk3-devel
Package
- Name
- webkit2gtk3-devel
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2
TuxCare:AlmaLinux:9.2 / webkit2gtk3-jsc
Package
- Name
- webkit2gtk3-jsc
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2