SB20260415183 - SUSE update for webkit2gtk3
Published: April 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2023-43010)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
2) Buffer overflow (CVE-ID: CVE-2025-31223)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit engine. A remote attacker can trick the victim into visiting a specially crafted webpage, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Buffer overflow (CVE-ID: CVE-2025-31277)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can trick the victim into visiting a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Memory corruption (CVE-ID: CVE-2025-43213)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
5) Memory corruption (CVE-ID: CVE-2025-43214)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and crash the browser.
6) Buffer overflow (CVE-ID: CVE-2025-43433)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website. trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Use-after-free (CVE-ID: CVE-2025-43438)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
8) Buffer overflow (CVE-ID: CVE-2025-43441)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and crash the browser.
9) Use-after-free (CVE-ID: CVE-2025-43457)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
10) Use-after-free (CVE-ID: CVE-2025-43511)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in WebKit Web Inspector. A remote attacker can trick the victim into visiting a specially crafted website and perform a denial of service attack.
11) Improper Initialization (CVE-ID: CVE-2025-46299)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper initialization in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and disclose internal states of the app.
12) Buffer overflow (CVE-ID: CVE-2026-20608)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
13) Buffer overflow (CVE-ID: CVE-2026-20635)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
14) Buffer overflow (CVE-ID: CVE-2026-20636)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
15) Protection mechanism failure (CVE-ID: CVE-2026-20643)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures within the Navigation API in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and bypass Same Origin Policy.
16) Buffer overflow (CVE-ID: CVE-2026-20644)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
17) Buffer overflow (CVE-ID: CVE-2026-20652)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can trick the victim into visiting a specially crafted website and crash the browser.
18) Memory corruption (CVE-ID: CVE-2026-20664)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.
19) State Issues (CVE-ID: CVE-2026-20665)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a state management issue in WebKit. A remote attacker can trick the victim into visiting a specially crafted website and prevent Content Security Policy from being enforced.
20) State Issues (CVE-ID: CVE-2026-20676)
The vulnerability allows a remote attacker to track website users.
The vulnerability exists due to a state issue in WebKit. A remote attacker can track users through Safari web extensions.
21) Information disclosure (CVE-ID: CVE-2026-20691)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the WebKit Sandboxing component. A remote attacker can gain fingerprint the user.
22) Memory corruption (CVE-ID: CVE-2026-28857)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim into opening a specially crafted file and perform an unexpected process crash.
23) Memory corruption (CVE-ID: CVE-2026-28859)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper input validation in WebKit when processing web content. A remote attacker can trick the victim into visiting a specially crafted website and force the browser into processing restricted web content outside the sandbox.
24) State Issues (CVE-ID: CVE-2026-28861)
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper handling of web content in WebKit when processing malicious web pages. A remote attacker can entice the victim to visit a specially crafted website and access script message handlers intended for other origins.
25) Universal cross-site scripting (CVE-ID: CVE-2026-28871)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in WebKit. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of an arbitrary website.
Remediation
Install update from vendor's website.