{"id":"CLSA-2026-1791973636","summary":"webkit2gtk3: Fix of 62 CVEs","details":"- Rebase to webkitgtk 2.54.0 (WebKitGTK Security Advisory WSA-2026-0006),\n  aligning with the release RHEL 9 ships (webkit2gtk3-2.54.0-1.el9_8,\n  RHSA-2026:69098).\n- Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch\n  and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from\n  c9s 2.54.0-2 and reverts 317619@main, which aborts Eclipse/SWT\n  applications on a RELEASE_ASSERT in initializeMainThread.\n- Drop fix-renderflexbox-typename.patch (was Patch17); the code it patched is\n  gone on 2.54.0.\n- Build with gcc-toolset-14 (GCC 14) instead of gcc-toolset-12; GCC 12\n  cannot compile 2.54.0 (ANGLE ResourceMap static_assert, LayoutRect\n  constexpr).\n- Backport the GStreamerCommon.h \u003cWebCore/GraphicsTypesGL.h\u003e include from\n  upstream 2.54.1; GCC resolves the symlinked WebCore private headers to\n  their real path, so the quoted include is not found when building the PCH.\n- Drop the vendored Skia backports for CVE-2026-5870, CVE-2026-7920,\n  CVE-2026-7923, CVE-2026-10009 and CVE-2026-11663 (was Patch20..Patch24);\n  the Skia snapshot bundled with 2.54.0 already includes them.\n- CVEs resolved by this rebase (62 total):\n  CVE-2026-3538, CVE-2026-3909, CVE-2026-4460, CVE-2026-6298, CVE-2026-6364,\n  CVE-2026-7353, CVE-2026-7949, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983,\n  CVE-2026-9998, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985,\n  CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099,\n  CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11675,\n  CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-2026-14427,\n  CVE-2026-15766, CVE-2026-16417, CVE-2026-17702, CVE-2026-17745,\n  CVE-2026-17757, CVE-2026-17914, CVE-2026-19160, CVE-2026-19161,\n  CVE-2026-19176, CVE-2026-43804, CVE-2026-64713, CVE-2026-64728,\n  CVE-2026-64730, CVE-2026-64753, CVE-2026-64757, CVE-2026-64778,\n  CVE-2026-64779, CVE-2026-64782, CVE-2026-64783, CVE-2026-64784,\n  CVE-2026-65332, CVE-2026-65336, CVE-2026-65337, CVE-2026-65341,\n  CVE-2026-65351, CVE-2026-76041, CVE-2026-78376, CVE-2026-78914,\n  CVE-2026-79020, CVE-2026-79112, CVE-2026-79144, CVE-2026-79147,\n  CVE-2026-83596, CVE-2026-84359, CVE-2026-84635, CVE-2026-85049","modified":"2026-10-26T09:43:53.951328326Z","published":"2026-10-14T10:28:22Z","upstream":["CVE-2026-10009","CVE-2026-10011","CVE-2026-10977","CVE-2026-10985","CVE-2026-11024","CVE-2026-11039","CVE-2026-11057","CVE-2026-11099","CVE-2026-11121","CVE-2026-11124","CVE-2026-11159","CVE-2026-11663","CVE-2026-11675","CVE-2026-13971","CVE-2026-14389","CVE-2026-14414","CVE-2026-14427","CVE-2026-15766","CVE-2026-16417","CVE-2026-17702","CVE-2026-17745","CVE-2026-17757","CVE-2026-17914","CVE-2026-19160","CVE-2026-19161","CVE-2026-19176","CVE-2026-3538","CVE-2026-3909","CVE-2026-43804","CVE-2026-4460","CVE-2026-5870","CVE-2026-6298","CVE-2026-6364","CVE-2026-64713","CVE-2026-64728","CVE-2026-64730","CVE-2026-64753","CVE-2026-64757","CVE-2026-64778","CVE-2026-64779","CVE-2026-64782","CVE-2026-64783","CVE-2026-64784","CVE-2026-65332","CVE-2026-65336","CVE-2026-65337","CVE-2026-65341","CVE-2026-65351","CVE-2026-7353","CVE-2026-76041","CVE-2026-78376","CVE-2026-78914","CVE-2026-79020","CVE-2026-79112","CVE-2026-79144","CVE-2026-79147","CVE-2026-7920","CVE-2026-7923","CVE-2026-7949","CVE-2026-83596","CVE-2026-84359","CVE-2026-84635","CVE-2026-85049","CVE-2026-8510","CVE-2026-8579","CVE-2026-9983","CVE-2026-9998"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791973636.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10011"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10977"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10985"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11024"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11039"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11057"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11099"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11121"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11124"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11159"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11675"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13971"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14389"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14414"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14427"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15766"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16417"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17702"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17745"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17757"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17914"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19160"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19161"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19176"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3538"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3909"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43804"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4460"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6298"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6364"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64713"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64728"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64730"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64753"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64757"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64778"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64779"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64782"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64783"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64784"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65332"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65336"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65337"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65341"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65351"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7353"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76041"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78376"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78914"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79020"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79112"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79144"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79147"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7949"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83596"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84359"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84635"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85049"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8510"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8579"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9983"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9998"}],"affected":[{"package":{"name":"webkit2gtk3","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.0-1.el9.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"}},{"package":{"name":"webkit2gtk3-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.0-1.el9.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"}},{"package":{"name":"webkit2gtk3-jsc","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.0-1.el9.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"}},{"package":{"name":"webkit2gtk3-jsc-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.0-1.el9.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"}}],"schema_version":"1.9.0"}