[Git][security-tracker-team/security-tracker][master] webkit2gtk / wpewebkit upstream advisory WSA-2026-0003

Alberto Garcia (@berto) berto at debian.org
Thu Jul 23 09:40:50 BST 2026 


Alberto Garcia pushed to branch master at Debian Security Tracker / security-tracker


Commits:
40a26480 by Alberto Garcia at 2026-07-23T10:40:33+02:00
webkit2gtk / wpewebkit upstream advisory WSA-2026-0003

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -55129,11 +55129,25 @@ CVE-2026-43666 (An out-of-bounds write issue was addressed with improved bounds
 CVE-2026-43661 (A buffer overflow issue was addressed with improved memory handling. T ...)
 	NOT-FOR-US: Apple
 CVE-2026-43660 (A validation issue was addressed with improved logic. This issue is fi ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-43659 (A race condition was addressed with additional validation. This issue  ...)
 	NOT-FOR-US: Apple
 CVE-2026-43658 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-43656 (An out-of-bounds write issue was addressed with improved input validat ...)
 	NOT-FOR-US: Apple
 CVE-2026-43655 (An out-of-bounds read was addressed with improved bounds checking. Thi ...)
@@ -55295,31 +55309,73 @@ CVE-2026-28961 (This issue was addressed with improved checks. This issue is fix
 CVE-2026-28959 (A buffer overflow was addressed with improved bounds checking. This is ...)
 	NOT-FOR-US: Apple
 CVE-2026-28958 (This issue was addressed with improved data protection. This issue is  ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28957 (An issue with app access to camera metadata was addressed with improve ...)
 	NOT-FOR-US: Apple
 CVE-2026-28956 (A memory corruption issue was addressed with improved input validation ...)
 	NOT-FOR-US: Apple
 CVE-2026-28955 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28954 (A file quarantine bypass was addressed with additional checks. This is ...)
 	NOT-FOR-US: Apple
 CVE-2026-28953 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28952 (An integer overflow was addressed with improved input validation. This ...)
 	NOT-FOR-US: Apple
 CVE-2026-28951 (An authorization issue was addressed with improved state management. T ...)
 	NOT-FOR-US: Apple
 CVE-2026-28947 (A use-after-free issue was addressed with improved memory management.  ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28946 (A use-after-free issue was addressed with improved memory management.  ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28944 (The issue was addressed with improved memory handling. This issue is f ...)
 	NOT-FOR-US: Apple
 CVE-2026-28943 (A logging issue was addressed with improved data redaction. This issue ...)
 	NOT-FOR-US: Apple
 CVE-2026-28942 (A use-after-free issue was addressed with improved memory management.  ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28941 (The issue was addressed with improved checks. This issue is fixed in i ...)
 	NOT-FOR-US: Apple
 CVE-2026-28940 (The issue was addressed with improved memory handling. This issue is f ...)
@@ -55357,23 +55413,72 @@ CVE-2026-28910 (This issue was addressed with improved permissions checking. Thi
 CVE-2026-28908 (A denial of service issue was addressed by removing the vulnerable cod ...)
 	NOT-FOR-US: Apple
 CVE-2026-28907 (The issue was addressed with improved input validation. This issue is  ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28906 (This issue was addressed through improved state management. This issue ...)
 	NOT-FOR-US: Apple
 CVE-2026-28905 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28904 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28903 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28902 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28901 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28897 (A buffer overflow was addressed with improved input validation. This i ...)
 	NOT-FOR-US: Apple
 CVE-2026-28883 (A use-after-free issue was addressed with improved memory management.  ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28873 (This issue was addressed with additional entitlement checks. This issu ...)
 	NOT-FOR-US: Apple
 CVE-2026-28872 (A resource exhaustion issue was addressed with improved input validati ...)
@@ -55383,7 +55488,14 @@ CVE-2026-28860 (The issue was addressed with improved input validation. This iss
 CVE-2026-28848 (A buffer overflow was addressed with improved bounds checking. This is ...)
 	NOT-FOR-US: Apple
 CVE-2026-28847 (The issue was addressed with improved memory handling. This issue is f ...)
-	NOT-FOR-US: Apple
+	- webkit2gtk 2.52.4-1
+	[bookworm] - webkit2gtk <end-of-life> (see DSA-6232-1)
+	[bullseye] - webkit2gtk <end-of-life> (EOL in bullseye)
+	- wpewebkit 2.52.4-1
+	[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
+	[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
+	[bullseye] - wpewebkit <end-of-life> (see #1035997)
+	NOTE: https://webkitgtk.org/security/WSA-2026-0003.html
 CVE-2026-28846 (A buffer overflow was addressed with improved bounds checking. This is ...)
 	NOT-FOR-US: Apple
 CVE-2026-28840 (A permissions issue was addressed with additional restrictions. This i ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/40a26480b3f5153fe18b448991196eba38ed7627

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/40a26480b3f5153fe18b448991196eba38ed7627
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260723/6acbea12/attachment.htm>

More information about the debian-security-tracker-commits mailing list