Most recent entries from all

ALSA-2026:69098 — Important: webkit2gtk3 security update

Affected: AlmaLinux:9: webkit2gtk3, AlmaLinux:9: webkit2gtk3-devel, AlmaLinux:9: webkit2gtk3-jsc, AlmaLinux:9: webkit2gtk3-jsc-devel

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154) * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173) * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161) * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176) * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984) * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804) * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713) * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787) * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783) * webkitgtk: use-after-free of JSCValue f…

certfr-2026-avi-1038 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2026-avi-1038

fkie_cve-2026-65351

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.

GCVE-1988-2026-0283 — APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1

Affected: APPLE-SA-08-17-2026-1 iOS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1

iOS 26.6.1 and iPadOS 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148282.

Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories.

Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to leak sensitive user information Description: A logic issue was addressed with improved checks. CVE-2026-65339: Meta Red Team X - Nik Tsytsarkin

ImageIO Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved checks. CVE-2026-65347: Geonha Lee (@leegn4a)

GHSA-vqhq-xrg7-4pc8

This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

NCSC-2026-0317 — Kwetsbaarheden verholpen in Apple macOS

NCSC-2026-0317

RHSA-2026:69098 — Red Hat Security Advisory: webkit2gtk3 security update

chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page chromium: skia: chromium: skia: Heap buffer overflow in Skia chromium: skia: chromium: skia: Heap buffer overflow in Skia chromium: skia: chromium: skia: Heap buffer overflow in Skia chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia chromium-browser: skia: chromium-browser: skia: Use after free in Skia chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia chromium-browser: skia: chromium-browser: skia: Use after free in Skia chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia chromium-browser:…

RLSA-2026:69098 — Important: webkit2gtk3 security update

Affected: Rocky Linux:9: webkit2gtk3

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)

* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)

* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)

* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)

* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)

* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)

* webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)

* webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)

* webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)

* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)

* webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)

* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)

* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)

* webkitgtk: use-after-free of JSCValue function parameters…