Red Hat Security Advisory: webkitgtk4 security update

CVE-2014-1745 — webkitgtk: Processing a file may lead to a denial of service or potentially disclose memory contents CVE-2020-9802 — webkitgtk: Logic issue may lead to arbitrary code execution CVE-2020-9803 — webkitgtk: Memory corruption may lead to arbitrary code execution CVE-2020-9805 — webkitgtk: Logic issue may lead to cross site scripting CVE-2020-9806 — webkitgtk: Memory corruption may lead to arbitrary code execution CVE-2020-9807 — webkitgtk: Memory corruption may lead to arbitrary code execution CVE-2020-9843 — webkitgtk: Input validation issue may lead to cross site scripting CVE-2020-9850 — webkitgtk: Logic issue may lead to arbitrary code execution CVE-2020-9862 — webkitgtk: Command injection in web inspector CVE-2020-9893 — webkitgtk: Use-after-free may lead to application termination or arbitrary code execution CVE-2020-9894 — webkitgtk: Out-of-bounds read may lead to unexpected application termination or arbitrary code execution CVE-2020-9895 — webkitgtk: Use-after-free may lead to application termination or arbitrary code execution CVE-2020-9915 — webkitgtk: Access issue in content security policy CVE-2020-9925 — webkitgtk: A logic issue may lead to cross site scripting CVE-2020-9947 — webkitgtk: use after free issue may lead to arbitrary code execution CVE-2020-9948 — webkitgtk: type confusion may lead to arbitrary code execution CVE-2020-9951 — webkitgtk: use-after-free may lead to arbitrary code execution CVE-2020-9952 — webkitgtk: input validation issue may lead to a cross site scripting CVE-2020-9983 — webkitgtk: out-of-bounds write may lead to code execution CVE-2020-13543 — webkitgtk: use-after-free may lead to arbitrary code execution CVE-2020-13558 — webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution CVE-2020-13584 — webkitgtk: use-after-free may lead to arbitrary code execution CVE-2020-13753 — webkitgtk: Improper access management to CLONE_NEWUSER and the TIOCSTI ioctl CVE-2020-27918 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2020-29623 — webkitgtk: User may be unable to fully delete browsing history CVE-2021-1765 — webkitgtk: IFrame sandboxing policy violation CVE-2021-1788 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2021-1789 — webkitgtk: Type confusion issue leading to arbitrary code execution CVE-2021-1799 — webkitgtk: Access to restricted ports on arbitrary servers via port redirection CVE-2021-1801 — webkitgtk: IFrame sandboxing policy violation CVE-2021-1817 — webkitgtk: Memory corruption leading to arbitrary code execution CVE-2021-1820 — webkitgtk: Memory initialization issue possibly leading to memory disclosure CVE-2021-1825 — webkitgtk: Input validation issue leading to cross site scripting attack CVE-2021-1826 — webkitgtk: Logic issue leading to universal cross site scripting attack CVE-2021-1844 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2021-1870 — webkitgtk: Logic issue leading to arbitrary code execution CVE-2021-1871 — webkitgtk: Logic issue leading to arbitrary code execution CVE-2021-21775 — webkitgtk: Use-after-free in ImageLoader dispatchPendingErrorEvent leading to information leak and possibly code execution CVE-2021-21779 — webkitgtk: Use-after-free in WebCore::GraphicsContext leading to information leak and possibly code execution CVE-2021-21806 — webkitgtk: Use-after-free in fireEventListeners leading to arbitrary code execution CVE-2021-30661 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2021-30663 — webkitgtk: Integer overflow leading to arbitrary code execution CVE-2021-30665 — webkitgtk: Memory corruption leading to arbitrary code execution CVE-2021-30666 — webkitgtk: Buffer overflow leading to arbitrary code execution CVE-2021-30682 — webkitgtk: Logic issue leading to leak of sensitive user information CVE-2021-30689 — webkitgtk: Logic issue leading to universal cross site scripting attack CVE-2021-30720 — webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers CVE-2021-30734 — webkitgtk: Memory corruptions leading to arbitrary code execution CVE-2021-30744 — webkitgtk: Cross-origin issue with iframe elements leading to universal cross site scripting attack CVE-2021-30749 — webkitgtk: Memory corruptions leading to arbitrary code execution CVE-2021-30758 — webkitgtk: Type confusion leading to arbitrary code execution CVE-2021-30761 — webkitgtk: Memory corruption leading to arbitrary code execution CVE-2021-30762 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2021-30795 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2021-30797 — webkitgtk: Insufficient checks leading to arbitrary code execution CVE-2021-30799 — webkitgtk: Memory corruptions leading to arbitrary code execution CVE-2021-30809 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2021-30818 — webkitgtk: Type confusion issue leading to arbitrary code execution CVE-2021-30823 — webkitgtk: Logic issue leading to HSTS bypass CVE-2021-30836 — webkitgtk: Out-of-bounds read leading to memory disclosure CVE-2021-30846 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2021-30848 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2021-30849 — webkitgtk: Multiple memory corruption issue leading to arbitrary code execution CVE-2021-30851 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2021-30884 — webkitgtk: CSS compositing issue leading to revealing of the browsing history CVE-2021-30887 — webkitgtk: Logic issue leading to Content Security Policy bypass CVE-2021-30888 — webkitgtk: Information leak via Content Security Policy reports CVE-2021-30889 — webkitgtk: Buffer overflow leading to arbitrary code execution CVE-2021-30890 — webkitgtk: Logic issue leading to universal cross-site scripting CVE-2021-30897 — webkitgtk: Cross-origin data exfiltration via resource timing API CVE-2021-30934 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30936 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30951 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30952 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30953 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30954 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30984 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-42762 — webkitgtk: limited sandbox escape via VFS syscalls CVE-2021-45481 — webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create CVE-2021-45482 — webkitgtk: use-after-free in WebCore::ContainerNode::firstChild CVE-2021-45483 — webkitgtk: use-after-free in WebCore::Frame::page CVE-2022-0108 — chromium-browser: Inappropriate implementation in Navigation CVE-2022-22589 — webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript CVE-2022-22590 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2022-22592 — webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced CVE-2022-22594 — webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2022-22620 — webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free CVE-2022-22624 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2022-22628 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2022-22629 — webkitgtk: Buffer overflow leading to arbitrary code execution CVE-2022-22637 — webkitgtk: logic issue was addressed with improved state management CVE-2022-22662 — webkitgtk: Cookie management issue leading to sensitive user information disclosure CVE-2022-22677 — webkitgtk: the video in a webRTC call may be interrupted if the audio capture gets interrupted CVE-2022-26700 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2022-26709 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2022-26710 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2022-26716 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2022-26717 — webkitgtk: Use-after-free leading to arbitrary code execution CVE-2022-26719 — webkitgtk: Memory corruption issue leading to arbitrary code execution CVE-2022-30293 — webkitgtk: Heap buffer overflow in WebCore::TextureMapperLayer::setContentsLayer leading to arbitrary code execution CVE-2022-30294 — webkitgtk: heap-buffer-overflow in WebCore::TextureMapperLayer::setContentsLayer CVE-2022-32792 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2022-32816 — webkitgtk: malicious content may lead to UI spoofing CVE-2022-32885 — webkitgtk: Memory corruption issue when processing web content CVE-2022-32886 — webkitgtk: buffer overflow issue was addressed with improved memory handling CVE-2022-32888 — webkitgtk: out-of-bounds write issue was addressed with improved bounds checking CVE-2022-32891 — webkitgtk: UI spoofing while Visiting a website that frames malicious content CVE-2022-32893 — webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution CVE-2022-32912 — webkitgtk: out-of-bounds read was addressed with improved bounds checking CVE-2022-32919 — webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing. CVE-2022-32923 — webkitgtk: correctness issue in the JIT was addressed with improved checks CVE-2022-32933 — webkitgtk: A website may able to track visited websites in private browsing CVE-2022-42799 — webkitgtk: issue was addressed with improved UI handling CVE-2022-42823 — webkitgtk: type confusion issue leading to arbitrary code execution CVE-2022-42824 — webkitgtk: sensitive information disclosure issue CVE-2022-42826 — webkitgtk: use-after-free issue leading to arbitrary code execution CVE-2022-42852 — webkitgtk: memory disclosure issue was addressed with improved memory handling CVE-2022-42856 — webkitgtk: processing maliciously crafted web content may lead to an arbitrary code execution CVE-2022-42863 — webkitgtk: memory corruption issue leading to arbitrary code execution CVE-2022-42867 — webkitgtk: use-after-free issue leading to arbitrary code execution CVE-2022-46691 — webkitgtk: memory corruption issue leading to arbitrary code execution CVE-2022-46692 — webkitgtk: Same Origin Policy bypass issue CVE-2022-46698 — webkitgtk: logic issue leading to user information disclosure CVE-2022-46699 — webkitgtk: memory corruption issue leading to arbitrary code execution CVE-2022-46700 — webkitgtk: memory corruption issue leading to arbitrary code execution CVE-2022-46705 — webkitgtk: Visiting a malicious website may lead to address bar spoofing CVE-2022-46725 — webkitgtk: Visiting a malicious website may lead to address bar spoofing. CVE-2022-48503 — webkitgtk: improper bounds checking leading to arbitrary code execution CVE-2023-23517 — webkitgtk: memory corruption issue leading to arbitrary code execution CVE-2023-23518 — webkitgtk: memory corruption issue leading to arbitrary code execution CVE-2023-23529 — webkitgtk: processing maliciously crafted web content may be exploited for arbitrary code execution CVE-2023-25358 — webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() CVE-2023-27932 — webkitgtk: Same Origin Policy bypass via crafted web content CVE-2023-27954 — webkitgtk: Website may be able to track sensitive user information CVE-2023-28198 — webkitgtk: use after free vulnerability CVE-2023-28204 — webkitgtk: an out-of-bounds read when processing malicious content CVE-2023-28205 — WebKitGTK: use-after-free leads to arbitrary code execution CVE-2023-32359 — webkitgtk: User password may be read aloud by a text-to-speech accessibility feature CVE-2023-32370 — webkitgtk: content security policy blacklist failure CVE-2023-32373 — webkitgtk: a use-after-free when processing maliciously crafted web content CVE-2023-32393 — webkitgtk: arbitrary code execution CVE-2023-32435 — webkitgtk: memory corruption issue leading to arbitrary code execution CVE-2023-32439 — webkitgtk: type confusion issue leading to arbitrary code execution CVE-2023-35074 — webkitgtk: processing web content may lead to arbitrary code execution CVE-2023-37450 — webkitgtk: arbitrary code execution CVE-2023-38133 — webkitgtk: disclose sensitive information CVE-2023-38572 — webkitgtk: bypass Same Origin Policy CVE-2023-38592 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-38594 — webkitgtk: arbitrary code execution CVE-2023-38595 — webkitgtk: arbitrary code execution CVE-2023-38597 — webkitgtk: arbitrary code execution CVE-2023-38599 — webkitgtk: track sensitive user information CVE-2023-38600 — webkitgtk: arbitrary code execution CVE-2023-38611 — webkitgtk: arbitrary code execution CVE-2023-39928 — webkitgtk: use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports CVE-2023-40397 — webkitgtk: arbitrary javascript code execution CVE-2023-40414 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-40451 — webkitgtk: attacker with JavaScript execution may be able to execute arbitrary code CVE-2023-41074 — webkitgtk: processing web content may lead to arbitrary code execution CVE-2023-41983 — webkitgtk: Processing web content may lead to a denial of service CVE-2023-41993 — webkitgtk: processing malicious web content may lead to arbitrary code execution CVE-2023-42833 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-42843 — webkit: visiting a malicious website may lead to address bar spoofing CVE-2023-42852 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-42875 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-42883 — webkitgtk: processing a malicious image may lead to a denial of service CVE-2023-42890 — webkitgtk: processing malicious web content may lead to arbitrary code execution CVE-2023-42916 — webkitgtk: Out-of-bounds read leads to sensitive data leak CVE-2023-42917 — webkitgtk: Arbitrary Remote Code Execution CVE-2023-42950 — webkit: heap use-after-free may lead to arbitrary code execution CVE-2023-42956 — webkit: processing malicious web content may lead to a denial of service CVE-2023-42970 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2023-43000 — webkitgtk: Processing maliciously crafted web content may lead to memory corruption CVE-2023-43010 — webkitgtk: Processing maliciously crafted web content may lead to memory corruption CVE-2024-4558 — chromium-browser: Use after free in ANGLE CVE-2024-23213 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2024-23222 — webkitgtk: type confusion may lead to arbitrary code execution CVE-2024-23252 — webkit: processing malicious web content may lead to denial-of-service CVE-2024-23254 — webkit: malicious website may exfiltrate audio data cross-origin CVE-2024-23263 — webkit: processing malicious web content prevents Content Security Policy from being enforced CVE-2024-23271 — webkitgtk: A malicious website may cause unexpected cross-origin behavior CVE-2024-23280 — webkit: maliciously crafted webpage may be able to fingerprint the user CVE-2024-23284 — webkit: processing maliciously crafted web content prevents Content Security Policy from being enforced CVE-2024-27808 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2024-27820 — webkitgtk: Processing web content may lead to arbitrary code execution CVE-2024-27833 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2024-27834 — webkit: pointer authentication bypass CVE-2024-27838 — webkitgtk: A maliciously crafted webpage may be able to fingerprint the user CVE-2024-27851 — webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2024-27856 — webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution CVE-2024-40776 — webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution CVE-2024-40779 — webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking CVE-2024-40780 — webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking CVE-2024-40782 — webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management CVE-2024-40789 — webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-40866 — webkitgtk: Visiting a malicious website may lead to address bar spoofing CVE-2024-44185 — webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-44187 — webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2024-44192 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-44244 — webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-44296 — webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced CVE-2024-44308 — webkitgtk: javascriptcore: processing maliciously crafted web content may lead to arbitrary code execution CVE-2024-44309 — webkitgtk: data isolation bypass vulnerability CVE-2024-54467 — webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2024-54479 — WebKitGTK: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-54502 — webkit: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-54505 — webkit: Processing maliciously crafted web content may lead to memory corruption CVE-2024-54508 — webkit: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-54534 — webkit: Processing maliciously crafted web content may lead to memory corruption CVE-2024-54543 — webkitgtk: Processing maliciously crafted web content may lead to memory corruption CVE-2024-54551 — webkitgtk: Processing web content may lead to a denial-of-service CVE-2024-54658 — webkitgtk: Processing web content may lead to a denial-of-service CVE-2025-24143 — webkitgtk: A maliciously crafted webpage may be able to fingerprint the user CVE-2025-24150 — webkitgtk: Copying a URL from Web Inspector may lead to command injection CVE-2025-24158 — webkitgtk: Processing web content may lead to a denial-of-service CVE-2025-24162 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-24201 — webkitgtk: out-of-bounds write vulnerability CVE-2025-24208 — webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack CVE-2025-24209 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-24213 — webkitgtk: A type confusion issue could lead to memory corruption CVE-2025-24216 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-24223 — webkitgtk: Processing maliciously crafted web content may lead to memory corruption CVE-2025-24264 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-30427 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-31204 — webkitgtk: Processing maliciously crafted web content may lead to memory corruption CVE-2025-31205 — webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2025-31206 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-31215 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2025-31257 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43480 — webkitgtk: A malicious website may exfiltrate data cross-origin