{"id":"CLSA-2026-1782217586","summary":"webkit2gtk3: Fix of 17 CVEs","details":"- Rebase to webkitgtk 2.52.4 to address WebKitGTK security advisory\n  WSA-2026-0003 (16 CVEs).\n- Refresh libsoup2.patch for 2.52.4 library version triplet bumps\n  (WEBKIT 21/8/21, JAVASCRIPTCORE 10/12/10 on API 4.1;\n  WEBKIT 20/8/16, JAVASCRIPTCORE 8/12/7 on API 6.0).\n- Drop aarch64-build.patch — the upstream cherry-pick (Apple fix for\n  WebKit bug 306638) is included in 2.52.4.\n- Add fix-system-malloc-llint-extractor.patch (upstream cherry-pick\n  314364@main, bugs.webkit.org/show_bug.cgi?id=316083) to gate\n  bmalloc_CopyHeaders in LLIntSettingsExtractor/LLIntOffsetsExtractor\n  dependencies on (NOT USE_SYSTEM_MALLOC). Without it, CMake configure\n  fails on aarch64 because USE_64KB_PAGE_BLOCK=ON forces\n  USE_SYSTEM_MALLOC=ON, which prevents the bmalloc subdirectory from\n  being added and the bmalloc_CopyHeaders target from being created.\n- CVEs resolved by this rebase (WSA-2026-0003):\n  CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902,\n  CVE-2026-28903, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907,\n  CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953,\n  CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, CVE-2026-43660","modified":"2026-10-26T09:30:22.280890172Z","published":"2026-07-20T09:05:48Z","upstream":["CVE-2026-28847","CVE-2026-28883","CVE-2026-28901","CVE-2026-28902","CVE-2026-28903","CVE-2026-28904","CVE-2026-28905","CVE-2026-28907","CVE-2026-28942","CVE-2026-28946","CVE-2026-28947","CVE-2026-28953","CVE-2026-28955","CVE-2026-28958","CVE-2026-43658","CVE-2026-43660"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782217586.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43214"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28847"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28883"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28901"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28902"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28903"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28904"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28905"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28907"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28942"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28946"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28947"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28953"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28955"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28958"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43658"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43660"}],"affected":[{"package":{"name":"webkit2gtk3","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1782217586.json"}},{"package":{"name":"webkit2gtk3-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1782217586.json"}},{"package":{"name":"webkit2gtk3-jsc","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1782217586.json"}},{"package":{"name":"webkit2gtk3-jsc-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1782217586.json"}}],"schema_version":"1.9.0"}