SUSE-SU-2026:2376-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2026:2376-1

HIGH8.8

Security update for webkit2gtk3

Published Jun 11, 2026

Modified 1 weeks ago

Fix available

Details

Description of the patch:

This update for webkit2gtk3 fixes the following issues

Update to version 2.52.4:

Security fixes:

CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code execution due to a heap buffer overflow (bsc#1267506).
CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after- free issue (bsc#1267507).
CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267508).
CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267509).
CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267510).
CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267511).
CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267512).
CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due to improper input validation (bsc#1267513).
CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free (bsc#1267514).
CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267515).
CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free (bsc#1267516).
CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1267517).
CVE-2026-28955: processing maliciously crafted web content may lead to an...

Affected Packages(24 packages)

WebKitGTK-4.0-lang

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

WebKitGTK-6.0-lang

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

libjavascriptcoregtk-4_0-18

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

libjavascriptcoregtk-6_0-1

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

libwebkit2gtk-4_0-37

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

libwebkitgtk-6_0-4

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

typelib-1_0-JavaScriptCore-4_0

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

typelib-1_0-WebKit2-4_0

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

typelib-1_0-WebKit2WebExtension-4_0

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

webkit2gtk-4_0-injected-bundles

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSS

Fixed in:

2.52.4-150600.12.68.1

References(36)

https://bugzilla.suse.com/1264745

https://bugzilla.suse.com/1267506

https://bugzilla.suse.com/1267507

https://bugzilla.suse.com/1267508

https://bugzilla.suse.com/1267509

https://bugzilla.suse.com/1267510

https://bugzilla.suse.com/1267511

https://bugzilla.suse.com/1267512

https://bugzilla.suse.com/1267513

https://bugzilla.suse.com/1267514

https://bugzilla.suse.com/1267515

https://bugzilla.suse.com/1267516

https://bugzilla.suse.com/1267517

https://bugzilla.suse.com/1267518

https://bugzilla.suse.com/1267519

https://bugzilla.suse.com/1267520

https://bugzilla.suse.com/1267521

https://lists.suse.com/pipermail/sle-updates/2026-June/047262.html

https://www.suse.com/security/cve/CVE-2026-28847/

https://www.suse.com/security/cve/CVE-2026-28883/

https://www.suse.com/security/cve/CVE-2026-28901/

https://www.suse.com/security/cve/CVE-2026-28902/

https://www.suse.com/security/cve/CVE-2026-28903/

https://www.suse.com/security/cve/CVE-2026-28904/

https://www.suse.com/security/cve/CVE-2026-28905/

CVSS Analysis

CVSS v3.1

8.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Upstream

CVE-2026-28847 CVE-2026-28883 CVE-2026-28901 CVE-2026-28902 CVE-2026-28903 CVE-2026-28904 CVE-2026-28905 CVE-2026-28907 CVE-2026-28942 CVE-2026-28946 CVE-2026-28947 CVE-2026-28953 CVE-2026-28955 CVE-2026-28958 CVE-2026-43658 CVE-2026-43660

Ecosystems(10)

SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7

Timeline

PublishedJun 11, 2026

ModifiedJun 11, 2026