{"id":"CLSA-2026-1782808694","summary":"webkit2gtk3: Fix of 4 CVEs","details":"- Rebase to webkitgtk 2.52.4. CVE-2025-46299 (uninitialized-memory\n  disclosure via maliciously crafted web content; WebKit bug 299518, fixed\n  upstream in 2.52.0 / WSA-2026-0001) has no isolatable backport -- the bug\n  is security-restricted and the fix ships only within the 2.52.x series.\n  Move webkit2gtk3 onto the 2.52.x security baseline, matching RHEL 9.6\n  (RHSA-2026:11329) and the almalinux9.2esu sibling.\n- CVEs still open on this branch that are resolved by this rebase:\n  CVE-2025-46299, CVE-2026-20664, CVE-2026-28857, CVE-2026-28859.\n- Drop the CVE-2026-* backport patches (Patch100..Patch117); all are fixed\n  upstream in 2.52.x and now provided by the 2.52.4 tarball.\n- Adopt the 2.52.x packaging/compat patch set (libsoup2, glib-2-68, icu-67,\n  g-ir-scanner-nonfatal, fix-system-malloc-llint-extractor, and the\n  compiler-neutral fix-* source fixes). Build natively with the AlmaLinux 9.6\n  clang + cmake 3.26.5 toolchain; no gcc-toolset-12 or linked cmake required.\n- Exclude i686: WebKit 2.52 fails CMake atomic-variable detection on 32-bit\n  x86 (matches almalinux9.2esu).","modified":"2026-10-26T09:31:14.044913400Z","published":"2026-06-30T08:38:40Z","upstream":["CVE-2025-46299","CVE-2026-20664","CVE-2026-28857","CVE-2026-28859"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782808694.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46299"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20664"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28857"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28859"}],"affected":[{"package":{"name":"webkit2gtk3","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1782808694.json"}},{"package":{"name":"webkit2gtk3-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1782808694.json"}},{"package":{"name":"webkit2gtk3-jsc","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1782808694.json"}},{"package":{"name":"webkit2gtk3-jsc-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.4-1.el9_6.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1782808694.json"}}],"schema_version":"1.9.0"}