CVE-2025-24208

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.

References

Affected packages

Debian:11 / webkit2gtk

Package

Name: webkit2gtk
Purl: pkg:deb/debian/webkit2gtk?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.32.3-1

2.32.4-1~deb10u1

2.32.4-1~deb11u1

2.32.4-1

2.33.1-1

2.33.2-1

2.33.3-1

2.33.90-1

2.33.91-1

2.34.0-1~bpo11+1

2.34.0-1

2.34.1-1~deb10u1

2.34.1-1~deb11u1

2.34.1-1

2.34.2-1~bpo11+1

2.34.2-1

2.34.3-1~deb10u1

2.34.3-1~deb11u1

2.34.3-1

2.34.4-1~deb10u1

2.34.4-1~deb11u1

2.34.4-1

2.34.5-1

2.34.6-1~deb10u1

2.34.6-1~deb11u1

2.34.6-1

2.35.1-1

2.35.2-1

2.35.3-1

2.35.90-1

2.36.0-1

2.36.0-2

2.36.0-3~deb10u1

2.36.0-3~deb11u1

2.36.0-3

2.36.1-1

2.36.2-1

2.36.3-1~deb10u1

2.36.3-1~deb11u1

2.36.3-1

2.36.4-1~deb10u1

2.36.4-1~deb11u1

2.36.4-1

2.36.6-1~deb10u1

2.36.6-1~deb11u1

2.36.6-1

2.36.7-1~deb10u1

2.36.7-1~deb11u1

2.36.7-1

2.37.1-1

2.37.1-2

2.37.90-1

2.37.91-1

2.38.0-1~deb10u1

2.38.0-1~deb11u1

2.38.0-1

2.38.0-2

2.38.0-3

2.38.1-1

2.38.2-1~deb10u1

2.38.2-1~deb11u1

2.38.2-1

2.38.3-1~deb10u1

2.38.3-1~deb11u1

2.38.3-1

2.38.4-1

2.38.4-2~deb10u1

2.38.4-2~deb11u1

2.38.4-2

2.38.5-1~deb10u1

2.38.5-1~deb11u1

2.38.5-1

2.38.5-1+m68k

2.39.1-1

2.39.2-1

2.39.3-1

2.39.4-1

2.39.5-1

2.39.7-1

2.39.90-1

2.39.91-1

2.40.0-1

2.40.0-2

2.40.0-3

2.40.1-1~deb11u1

2.40.1-1

2.40.2-1~deb11u1

2.40.2-1~deb12u1

2.40.2-1

2.40.3-1

2.40.3-2~deb11u1

2.40.3-2~deb11u2

2.40.3-2~deb12u1

2.40.3-2~deb12u2

2.40.3-2

2.40.4-1

2.40.5-1~deb11u1

2.40.5-1~deb12u1

2.40.5-1

2.41.4-1

2.41.5-1

2.41.6-1

2.41.90-1

2.41.91-1

2.41.91-2

2.41.92-1

2.42.0-1~bpo12+1

2.42.0-1

2.42.1-1~bpo12+1

2.42.1-1~deb11u1

2.42.1-1~deb11u2

2.42.1-1~deb12u1

2.42.1-1

2.42.1-2

2.42.2-1~deb11u1

2.42.2-1~deb12u1

2.42.2-1

2.42.3-1~deb11u1

2.42.3-1~deb12u1

2.42.3-1

2.42.4-1~deb11u1

2.42.4-1~deb12u1

2.42.4-1

2.42.5-1~deb11u1

2.42.5-1~deb12u1

2.42.5-1

2.42.5-2

2.43.1-1

2.43.2-1

2.43.3-1

2.43.4-1

2.43.4-2

2.44.0-1

2.44.0-2

2.44.1-1~deb11u1

2.44.1-1~deb12u1

2.44.1-1

2.44.2-1~deb11u1

2.44.2-1~deb12u1

2.44.2-1

2.44.3-1~deb11u1

2.44.3-1~deb12u1

2.44.3-1

2.44.4-1

2.45.1-1

2.45.1-2

2.45.2-1

2.45.3-1

2.45.4-1

2.45.5-1

2.45.6-1

2.45.91-1

2.45.92-1

2.46.0-1

2.46.0-2~deb12u1

2.46.0-2

2.46.1-1

2.46.1-2~bpo12+1

2.46.1-2

2.46.2-1

2.46.3-1~deb11u1

2.46.3-1~deb11u2

2.46.3-1~deb12u1

2.46.3-1

2.46.4-1~deb11u1

2.46.4-1~deb12u1

2.46.4-1

2.46.5-1~deb11u1

2.46.5-1~deb12u1

2.46.5-1

2.46.5-1+hurd.1

2.46.5-1+hurd.2

2.46.6-1~deb11u1

2.46.6-1~deb12u1

2.46.6-1

2.47.1-1

2.47.2-1

2.47.3-1

2.47.4-1

2.47.90-1

2.48.0-1~deb12u1

2.48.0-1

2.48.0-1+alpha

2.48.0-1+hurd.1

2.48.0-1+hurd.2

2.48.1-1

2.48.1-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / webkit2gtk

Package

Name: webkit2gtk
Purl: pkg:deb/debian/webkit2gtk?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.48.1-2~deb12u1

Affected versions

2.*

2.40.1-1

2.40.2-1~deb11u1

2.40.2-1~deb12u1

2.40.2-1

2.40.3-1

2.40.3-2~deb11u1

2.40.3-2~deb11u2

2.40.3-2~deb12u1

2.40.3-2~deb12u2

2.40.3-2

2.40.4-1

2.40.5-1~deb11u1

2.40.5-1~deb12u1

2.40.5-1

2.41.4-1

2.41.5-1

2.41.6-1

2.41.90-1

2.41.91-1

2.41.91-2

2.41.92-1

2.42.0-1~bpo12+1

2.42.0-1

2.42.1-1~bpo12+1

2.42.1-1~deb11u1

2.42.1-1~deb11u2

2.42.1-1~deb12u1

2.42.1-1

2.42.1-2

2.42.2-1~deb11u1

2.42.2-1~deb12u1

2.42.2-1

2.42.3-1~deb11u1

2.42.3-1~deb12u1

2.42.3-1

2.42.4-1~deb11u1

2.42.4-1~deb12u1

2.42.4-1

2.42.5-1~deb11u1

2.42.5-1~deb12u1

2.42.5-1

2.42.5-2

2.43.1-1

2.43.2-1

2.43.3-1

2.43.4-1

2.43.4-2

2.44.0-1

2.44.0-2

2.44.1-1~deb11u1

2.44.1-1~deb12u1

2.44.1-1

2.44.2-1~deb11u1

2.44.2-1~deb12u1

2.44.2-1

2.44.3-1~deb11u1

2.44.3-1~deb12u1

2.44.3-1

2.44.4-1

2.45.1-1

2.45.1-2

2.45.2-1

2.45.3-1

2.45.4-1

2.45.5-1

2.45.6-1

2.45.91-1

2.45.92-1

2.46.0-1

2.46.0-2~deb12u1

2.46.0-2

2.46.1-1

2.46.1-2~bpo12+1

2.46.1-2

2.46.2-1

2.46.3-1~deb11u1

2.46.3-1~deb11u2

2.46.3-1~deb12u1

2.46.3-1

2.46.4-1~deb11u1

2.46.4-1~deb12u1

2.46.4-1

2.46.5-1~deb11u1

2.46.5-1~deb12u1

2.46.5-1

2.46.5-1+hurd.1

2.46.5-1+hurd.2

2.46.6-1~deb11u1

2.46.6-1~deb12u1

2.46.6-1

2.47.1-1

2.47.2-1

2.47.3-1

2.47.4-1

2.47.90-1

2.48.0-1~deb12u1

2.48.0-1

2.48.0-1+alpha

2.48.0-1+hurd.1

2.48.0-1+hurd.2

2.48.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / webkit2gtk

Package

Name: webkit2gtk
Purl: pkg:deb/debian/webkit2gtk?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.48.1-1

Affected versions

2.*

2.40.1-1

2.40.2-1~deb11u1

2.40.2-1~deb12u1

2.40.2-1

2.40.3-1

2.40.3-2~deb11u1

2.40.3-2~deb11u2

2.40.3-2~deb12u1

2.40.3-2~deb12u2

2.40.3-2

2.40.4-1

2.40.5-1~deb11u1

2.40.5-1~deb12u1

2.40.5-1

2.41.4-1

2.41.5-1

2.41.6-1

2.41.90-1

2.41.91-1

2.41.91-2

2.41.92-1

2.42.0-1~bpo12+1

2.42.0-1

2.42.1-1~bpo12+1

2.42.1-1~deb11u1

2.42.1-1~deb11u2

2.42.1-1~deb12u1

2.42.1-1

2.42.1-2

2.42.2-1~deb11u1

2.42.2-1~deb12u1

2.42.2-1

2.42.3-1~deb11u1

2.42.3-1~deb12u1

2.42.3-1

2.42.4-1~deb11u1

2.42.4-1~deb12u1

2.42.4-1

2.42.5-1~deb11u1

2.42.5-1~deb12u1

2.42.5-1

2.42.5-2

2.43.1-1

2.43.2-1

2.43.3-1

2.43.4-1

2.43.4-2

2.44.0-1

2.44.0-2

2.44.1-1~deb11u1

2.44.1-1~deb12u1

2.44.1-1

2.44.2-1~deb11u1

2.44.2-1~deb12u1

2.44.2-1

2.44.3-1~deb11u1

2.44.3-1~deb12u1

2.44.3-1

2.44.4-1

2.45.1-1

2.45.1-2

2.45.2-1

2.45.3-1

2.45.4-1

2.45.5-1

2.45.6-1

2.45.91-1

2.45.92-1

2.46.0-1

2.46.0-2~deb12u1

2.46.0-2

2.46.1-1

2.46.1-2~bpo12+1

2.46.1-2

2.46.2-1

2.46.3-1~deb11u1

2.46.3-1~deb11u2

2.46.3-1~deb12u1

2.46.3-1

2.46.4-1~deb11u1

2.46.4-1~deb12u1

2.46.4-1

2.46.5-1~deb11u1

2.46.5-1~deb12u1

2.46.5-1

2.46.5-1+hurd.1

2.46.5-1+hurd.2

2.46.6-1~deb11u1

2.46.6-1~deb12u1

2.46.6-1

2.47.1-1

2.47.2-1

2.47.3-1

2.47.4-1

2.47.90-1

2.48.0-1~deb12u1

2.48.0-1

2.48.0-1+alpha

2.48.0-1+hurd.1

2.48.0-1+hurd.2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / wpewebkit

Package

Name: wpewebkit
Purl: pkg:deb/debian/wpewebkit?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.32.3-2

2.32.4-1~deb11u1

2.32.4-1

2.34.1-1~deb11u1

2.34.1-1

2.34.2-1

2.34.3-1~deb11u1

2.34.3-1

2.34.4-1~deb11u1

2.34.4-1

2.34.5-1

2.34.6-1~deb11u1

2.34.6-1

2.36.0-1

2.36.0-2~deb11u1

2.36.0-2

2.36.1-1

2.36.3-1~deb11u1

2.36.3-1

2.36.4-1~deb11u1

2.36.4-1

2.36.6-1~deb11u1

2.36.6-1

2.36.7-1~deb11u1

2.36.7-1

2.38.0-1~deb11u1

2.38.0-1

2.38.1-1

2.38.2-1~deb11u1

2.38.2-1

2.38.3-1~deb11u1

2.38.3-1

2.38.4-1~deb11u1

2.38.4-1

2.38.5-1~deb11u1

2.38.5-1

2.38.6-1~deb11u1

2.38.6-1

2.39.91-1

2.40.0-1

2.40.1-1

2.40.2-1

2.40.2-2

2.40.3-1

2.40.4-1

2.40.5-1

2.42.0-1

2.42.1-1

2.42.2-1

2.42.3-1

2.42.4-1

2.42.5-1

2.42.5-1.1~exp1

2.42.5-1.1

2.42.5-1.2

2.42.5-2~exp

2.44.1-1

2.44.2-1

2.44.2-2

2.44.3-1

2.44.4-1

2.46.1-1

2.46.2-1

2.46.3-1

2.46.4-1

2.46.5-1

2.46.6-1

2.48.0-1

2.48.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / wpewebkit

Package

Name: wpewebkit
Purl: pkg:deb/debian/wpewebkit?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.38.6-1

2.39.91-1

2.40.0-1

2.40.1-1

2.40.2-1

2.40.2-2

2.40.3-1

2.40.4-1

2.40.5-1

2.42.0-1

2.42.1-1

2.42.2-1

2.42.3-1

2.42.4-1

2.42.5-1

2.42.5-1.1~exp1

2.42.5-1.1

2.42.5-1.2

2.42.5-2~exp

2.44.1-1

2.44.2-1

2.44.2-2

2.44.3-1

2.44.4-1

2.46.1-1

2.46.2-1

2.46.3-1

2.46.4-1

2.46.5-1

2.46.6-1

2.48.0-1

2.48.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / wpewebkit

Package

Name: wpewebkit
Purl: pkg:deb/debian/wpewebkit?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.48.1-1

Affected versions

2.*

2.38.6-1

2.39.91-1

2.40.0-1

2.40.1-1

2.40.2-1

2.40.2-2

2.40.3-1

2.40.4-1

2.40.5-1

2.42.0-1

2.42.1-1

2.42.2-1

2.42.3-1

2.42.4-1

2.42.5-1

2.42.5-1.1~exp1

2.42.5-1.1

2.42.5-1.2

2.42.5-2~exp

2.44.1-1

2.44.2-1

2.44.2-2

2.44.3-1

2.44.4-1

2.46.1-1

2.46.2-1

2.46.3-1

2.46.4-1

2.46.5-1

2.46.6-1

2.48.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}