Vulnerability-Lookup

UBUNTU-CVE-2025-43529 (CVE-2025-43529)

Vulnerability from osv_ubuntu – Published: 2025-12-17 21:16 – Updated: 2026-09-16 11:29 – Source website

Details

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      high

References

URL

Type

	https://ubuntu.com/security/CVE-2025-43529	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-43529	REPORT
	https://webkitgtk.org/security/WSA-2025-0010.html	REPORT
	https://support.apple.com/en-us/125884	REPORT
	https://support.apple.com/en-us/125885	REPORT
	https://support.apple.com/en-us/125886	REPORT
	https://support.apple.com/en-us/125889	REPORT
	https://support.apple.com/en-us/125890	REPORT
	https://support.apple.com/en-us/125891	REPORT
	https://support.apple.com/en-us/125892	REPORT
	https://www.cisa.gov/known-exploited-vulnerabilit…	REPORT
	https://ubuntu.com/security/notices/USN-7957-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqtwebkit-qmlwebkitplugin",
            "binary_version": "2.3.2-0ubuntu11"
          },
          {
            "binary_name": "libqtwebkit4",
            "binary_version": "2.3.2-0ubuntu11"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qtwebkit-source",
        "purl": "pkg:deb/ubuntu/qtwebkit-source@2.3.2-0ubuntu11?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.2-0ubuntu10",
        "2.3.2-0ubuntu11"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-3.0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-webkit-3.0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "gir1.2-webkit2-3.0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-1.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-bin",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkit2gtk-3.0-25",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-1.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-1.0-common",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-3.0-0",
            "binary_version": "2.4.11-0ubuntu0.1"
          },
          {
            "binary_name": "libwebkitgtk-3.0-common",
            "binary_version": "2.4.11-0ubuntu0.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "webkitgtk",
        "purl": "pkg:deb/ubuntu/webkitgtk@2.4.11-0ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.9-2ubuntu2",
        "2.4.10-0ubuntu1",
        "2.4.11-0ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          },
          {
            "binary_name": "libqt5webkit5-qmlwebkitplugin",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          },
          {
            "binary_name": "qtwebkit5-doc-html",
            "binary_version": "5.5.1+dfsg-2ubuntu1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.5.1+dfsg-2ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.4.2+dfsg-1ubuntu2.1",
        "5.5.1+dfsg-2ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37-gtk2",
            "binary_version": "2.20.5-0ubuntu0.16.04.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.20.5-0ubuntu0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.5+dfsg1-3",
        "2.10.3+dfsg1-1",
        "2.10.4+dfsg1-1",
        "2.10.5-1",
        "2.10.6-1",
        "2.10.6-1ubuntu1",
        "2.10.8-1ubuntu1",
        "2.10.9-1ubuntu1",
        "2.12.5-0ubuntu0.16.04.1",
        "2.14.2-0ubuntu0.16.04.1",
        "2.14.3-0ubuntu0.16.04.1",
        "2.14.5-0ubuntu0.16.04.1",
        "2.16.1-0ubuntu0.16.04.1",
        "2.16.1-0ubuntu0.16.04.2",
        "2.16.2-0ubuntu0.16.04.1",
        "2.16.3-0ubuntu0.16.04.1",
        "2.16.6-0ubuntu0.16.04.1",
        "2.18.0-0ubuntu0.16.04.2",
        "2.18.3-0ubuntu0.16.04.1",
        "2.18.4-0ubuntu0.16.04.1",
        "2.18.5-0ubuntu0.16.04.1",
        "2.18.6-0ubuntu0.16.04.1",
        "2.20.1-0ubuntu0.16.04.1",
        "2.20.2-0ubuntu0.16.04.1",
        "2.20.3-0ubuntu0.16.04.1",
        "2.20.5-0ubuntu0.16.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.32.4-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.32.4-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.32.4-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.32.4-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.32.4-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37-gtk2",
            "binary_version": "2.32.4-0ubuntu0.18.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.32.4-0ubuntu0.18.04.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.32.4-0ubuntu0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.18.0-2",
        "2.18.0-2build1",
        "2.18.2-1",
        "2.18.3-1",
        "2.18.4-1",
        "2.18.6-1",
        "2.19.91-1ubuntu1",
        "2.19.92-1",
        "2.20.0-1",
        "2.20.0-2",
        "2.20.0-2ubuntu1",
        "2.20.1-1",
        "2.20.2-0ubuntu0.18.04.1",
        "2.20.3-0ubuntu0.18.04.1",
        "2.20.5-0ubuntu0.18.04.1",
        "2.22.2-0ubuntu0.18.04.1",
        "2.22.2-0ubuntu0.18.04.2",
        "2.22.4-0ubuntu0.18.04.1",
        "2.22.5-0ubuntu0.18.04.1",
        "2.22.6-0ubuntu0.18.04.1",
        "2.24.1-0ubuntu0.18.04.1",
        "2.24.2-0ubuntu0.18.04.1",
        "2.24.4-0ubuntu0.18.04.1",
        "2.26.1-0ubuntu0.18.04.1",
        "2.26.2-0ubuntu0.18.04.1",
        "2.26.3-0ubuntu0.18.04.1",
        "2.26.4-0ubuntu0.18.04.1",
        "2.28.0-0ubuntu0.18.04.3",
        "2.28.1-0ubuntu0.18.04.1",
        "2.28.2-0ubuntu0.18.04.1",
        "2.28.3-0ubuntu0.18.04.1",
        "2.28.4-0ubuntu0.18.04.1",
        "2.30.3-0ubuntu0.18.04.1",
        "2.30.5-0ubuntu0.18.04.1",
        "2.30.6-0ubuntu0.18.04.1",
        "2.32.0-0ubuntu0.18.04.1",
        "2.32.3-0ubuntu0.18.04.1",
        "2.32.4-0ubuntu0.18.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha2-7ubuntu1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha2-7ubuntu1"
          },
          {
            "binary_name": "qtwebkit5-doc-html",
            "binary_version": "5.212.0~alpha2-7ubuntu1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha2-7ubuntu1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.9.1+dfsg-5ubuntu1",
        "5.9.1+dfsg-5ubuntu3",
        "5.212.0~alpha2-5build2",
        "5.212.0~alpha2-5build4",
        "5.212.0~alpha2-7",
        "5.212.0~alpha2-7build2",
        "5.212.0~alpha2-7ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqtwebkit-qmlwebkitplugin",
            "binary_version": "2.3.2-0ubuntu13"
          },
          {
            "binary_name": "libqtwebkit4",
            "binary_version": "2.3.2-0ubuntu13"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "qtwebkit-source",
        "purl": "pkg:deb/ubuntu/qtwebkit-source@2.3.2-0ubuntu13?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.2-0ubuntu13"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-3.0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "gir1.2-webkit-3.0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libjavascriptcoregtk-1.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libjavascriptcoregtk-3.0-bin",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libwebkitgtk-1.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          },
          {
            "binary_name": "libwebkitgtk-3.0-0",
            "binary_version": "2.4.11-3ubuntu3"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "webkitgtk",
        "purl": "pkg:deb/ubuntu/webkitgtk@2.4.11-3ubuntu3?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.11-3",
        "2.4.11-3ubuntu2",
        "2.4.11-3ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.38.6-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.38.6-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.38.6-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.38.6-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.38.6-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37-gtk2",
            "binary_version": "2.38.6-0ubuntu0.20.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.38.6-0ubuntu0.20.04.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.38.6-0ubuntu0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26.1-3",
        "2.26.2-1",
        "2.26.3-1ubuntu2",
        "2.26.4-1ubuntu1",
        "2.28.0-1ubuntu2",
        "2.28.1-1",
        "2.28.2-0ubuntu0.20.04.1",
        "2.28.3-0ubuntu0.20.04.1",
        "2.28.4-0ubuntu0.20.04.1",
        "2.30.3-0ubuntu0.20.04.1",
        "2.30.5-0ubuntu0.20.04.1",
        "2.30.6-0ubuntu0.20.04.1",
        "2.32.0-0ubuntu0.20.04.1",
        "2.32.3-0ubuntu0.20.04.1",
        "2.32.4-0ubuntu0.20.04.1",
        "2.34.1-0ubuntu0.20.04.1",
        "2.34.3-0ubuntu0.20.04.1",
        "2.34.4-0ubuntu0.20.04.1",
        "2.34.6-0ubuntu0.20.04.1",
        "2.36.0-0ubuntu0.20.04.3",
        "2.36.2-0ubuntu0.20.04.1",
        "2.36.3-0ubuntu0.20.04.1",
        "2.36.4-0ubuntu0.20.04.1",
        "2.36.6-0ubuntu0.20.04.1",
        "2.36.7-0ubuntu0.20.04.1",
        "2.36.8-0ubuntu0.20.04.1",
        "2.38.2-0ubuntu0.20.04.1",
        "2.38.3-0ubuntu0.20.04.1",
        "2.38.4-0ubuntu0.20.04.2",
        "2.38.5-0ubuntu0.20.04.1",
        "2.38.6-0ubuntu0.20.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha4-1ubuntu2.1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha4-1ubuntu2.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha4-1ubuntu2.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.212.0~alpha3-3",
        "5.212.0~alpha3-5",
        "5.212.0~alpha3-6",
        "5.212.0~alpha3-7",
        "5.212.0~alpha4-1",
        "5.212.0~alpha4-1ubuntu1",
        "5.212.0~alpha4-1ubuntu2",
        "5.212.0~alpha4-1ubuntu2.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libwpewebkit-1.0-3",
            "binary_version": "2.28.1-1"
          },
          {
            "binary_name": "wpewebkit-driver",
            "binary_version": "2.28.1-1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "wpewebkit",
        "purl": "pkg:deb/ubuntu/wpewebkit@2.28.1-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.26.3-1",
        "2.26.4-1",
        "2.26.4-1build1",
        "2.28.0-1",
        "2.28.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha4-15ubuntu1"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha4-15ubuntu1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha4-15ubuntu1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.212.0~alpha4-12",
        "5.212.0~alpha4-13",
        "5.212.0~alpha4-14",
        "5.212.0~alpha4-14build1",
        "5.212.0~alpha4-14ubuntu2",
        "5.212.0~alpha4-15ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.1",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-6.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-webkit-6.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.1",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-6.0-1",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libwebkitgtk-6.0-4",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.50.4-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.4-0ubuntu0.22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.34.0-1ubuntu1",
        "2.34.1-1ubuntu1",
        "2.34.2-1ubuntu1",
        "2.34.3-1",
        "2.35.3-1ubuntu1",
        "2.35.90-1ubuntu1",
        "2.36.0-2ubuntu1",
        "2.36.2-0ubuntu0.22.04.1",
        "2.36.3-0ubuntu0.22.04.1",
        "2.36.4-0ubuntu0.22.04.1",
        "2.36.6-0ubuntu0.22.04.1",
        "2.36.7-0ubuntu0.22.04.1",
        "2.36.8-0ubuntu0.22.04.1",
        "2.38.2-0ubuntu0.22.04.2",
        "2.38.3-0ubuntu0.22.04.1",
        "2.38.4-0ubuntu0.22.04.1",
        "2.38.5-0ubuntu0.22.04.1",
        "2.38.6-0ubuntu0.22.04.1",
        "2.40.4-0ubuntu0.22.04.1",
        "2.40.5-0ubuntu0.22.04.1",
        "2.42.1-0ubuntu0.22.04.1",
        "2.42.2-0ubuntu0.22.04.1",
        "2.42.3-0ubuntu0.22.04.1",
        "2.42.4-0ubuntu0.22.04.1",
        "2.42.5-0ubuntu0.22.04.2",
        "2.44.0-0ubuntu0.22.04.1",
        "2.44.2-0ubuntu0.22.04.1",
        "2.44.3-0ubuntu0.22.04.1",
        "2.46.1-0ubuntu0.22.04.3",
        "2.46.3-0ubuntu0.22.04.1",
        "2.46.4-0ubuntu0.22.04.1",
        "2.46.5-0ubuntu0.22.04.1",
        "2.46.6-0ubuntu0.22.04.1",
        "2.48.0-0ubuntu0.22.04.1",
        "2.48.1-0ubuntu0.22.04.1",
        "2.48.3-0ubuntu0.22.04.1",
        "2.48.5-0ubuntu0.22.04.1",
        "2.48.7-0ubuntu0.22.04.2",
        "2.50.1-0ubuntu0.22.04.1",
        "2.50.2-0ubuntu0.22.04.2",
        "2.50.3-0ubuntu0.22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libwpewebkit-1.0-3",
            "binary_version": "2.36.0-2ubuntu3"
          },
          {
            "binary_name": "wpewebkit-driver",
            "binary_version": "2.36.0-2ubuntu3"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "wpewebkit",
        "purl": "pkg:deb/ubuntu/wpewebkit@2.36.0-2ubuntu3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.32.4-1",
        "2.34.1-1",
        "2.34.2-1",
        "2.34.3-1",
        "2.34.4-1",
        "2.34.5-1",
        "2.34.6-1",
        "2.36.0-2ubuntu2",
        "2.36.0-2ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libqt5webkit5",
            "binary_version": "5.212.0~alpha4-36"
          },
          {
            "binary_name": "qml-module-qtwebkit",
            "binary_version": "5.212.0~alpha4-36"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "qtwebkit-opensource-src",
        "purl": "pkg:deb/ubuntu/qtwebkit-opensource-src@5.212.0~alpha4-36?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.212.0~alpha4-33",
        "5.212.0~alpha4-33build1",
        "5.212.0~alpha4-34",
        "5.212.0~alpha4-34ubuntu3",
        "5.212.0~alpha4-34ubuntu4",
        "5.212.0~alpha4-36"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.1",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-6.0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "gir1.2-webkit-6.0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.1",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-6.0-1",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-bin",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libwebkitgtk-6.0-4",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.50.4-0ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.4-0ubuntu0.24.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.42.1-2",
        "2.42.2-1",
        "2.42.3-1",
        "2.42.4-1",
        "2.43.3-1",
        "2.43.3-1build2",
        "2.44.0-2",
        "2.44.2-0ubuntu0.24.04.1",
        "2.44.2-0ubuntu0.24.04.2",
        "2.44.3-0ubuntu0.24.04.1",
        "2.46.1-0ubuntu0.24.04.1",
        "2.46.3-0ubuntu0.24.04.1",
        "2.46.4-0ubuntu0.24.04.1",
        "2.46.5-0ubuntu0.24.04.1",
        "2.46.6-0ubuntu0.24.04.1",
        "2.48.0-0ubuntu0.24.04.1",
        "2.48.1-0ubuntu0.24.04.1",
        "2.48.3-0ubuntu0.24.04.1",
        "2.48.5-0ubuntu0.24.04.1",
        "2.48.7-0ubuntu0.24.04.2",
        "2.50.1-0ubuntu0.24.04.1",
        "2.50.2-0ubuntu0.24.04.2",
        "2.50.3-0ubuntu0.24.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.1",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-6.0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "gir1.2-webkit-6.0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.1",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-6.0-1",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-bin",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libwebkitgtk-6.0-4",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "webkitgtk-webdriver",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          }
        ],
        "priority_reason": "part of CISA-KEV"
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.50.4-0ubuntu0.25.10.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.4-0ubuntu0.25.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.48.1-1ubuntu1",
        "2.48.2-1ubuntu1",
        "2.48.2-1ubuntu2",
        "2.48.3-1ubuntu2",
        "2.48.6-1ubuntu2",
        "2.50.0-2ubuntu1",
        "2.50.0-2ubuntu1.1",
        "2.50.1-0ubuntu0.25.10.1",
        "2.50.2-0ubuntu0.25.10.2",
        "2.50.3-0ubuntu0.25.10.1"
      ]
    }
  ],
  "aliases": [],
  "details": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.",
  "id": "UBUNTU-CVE-2025-43529",
  "modified": "2026-09-16T11:29:52Z",
  "published": "2025-12-17T21:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-43529"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43529"
    },
    {
      "type": "REPORT",
      "url": "https://webkitgtk.org/security/WSA-2025-0010.html"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/en-us/125884"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/en-us/125885"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/en-us/125886"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/en-us/125889"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/en-us/125890"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/en-us/125891"
    },
    {
      "type": "REPORT",
      "url": "https://support.apple.com/en-us/125892"
    },
    {
      "type": "REPORT",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7957-1"
    }
  ],
  "related": [
    "USN-7957-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "high",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-43529"
  ]
}

CVE-2025-43529 (GCVE-0-2025-43529)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:46 – Updated: 2026-09-21 16:46

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-18 04:55 UTC

CWE

Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
CWE-416 - Use After Free

Assigner

apple mitre root

References

8 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125885
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125889
https://support.apple.com/en-us/125890
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/125892
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.3 (custom) Affected: 0 , < 26.2 (custom)
Apple	macOS	Affected: 0 , < 26.2 (custom)
Apple	tvOS	Affected: 0 , < 26.2 (custom)
Apple	visionOS	Affected: 0 , < 26.2 (custom)
Apple	watchOS	Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43529",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-18T04:55:16.426232Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-12-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:46:54.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:18:20.608Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/125885"
        },
        {
          "url": "https://support.apple.com/en-us/125886"
        },
        {
          "url": "https://support.apple.com/en-us/125889"
        },
        {
          "url": "https://support.apple.com/en-us/125890"
        },
        {
          "url": "https://support.apple.com/en-us/125891"
        },
        {
          "url": "https://support.apple.com/en-us/125892"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43529",
    "datePublished": "2025-12-17T20:46:55.691Z",
    "dateReserved": "2025-04-16T15:27:21.197Z",
    "dateUpdated": "2026-09-21T16:46:54.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

USN-7957-1 (UBUNTU-CVE-2025-14174)

Vulnerability from osv_ubuntu – Published: 2026-01-13 13:57 – Updated: 2026-04-22 07:37 – Source website

Summary

webkit2gtk vulnerabilities

Details

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

References

URL

Type

	https://ubuntu.com/security/notices/USN-7957-1	ADVISORY
	https://ubuntu.com/security/CVE-2025-14174	REPORT
	https://ubuntu.com/security/CVE-2025-43501	REPORT
	https://ubuntu.com/security/CVE-2025-43529	REPORT
	https://ubuntu.com/security/CVE-2025-43531	REPORT
	https://ubuntu.com/security/CVE-2025-43535	REPORT
	https://ubuntu.com/security/CVE-2025-43536	REPORT
	https://ubuntu.com/security/CVE-2025-43541	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-14174",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43501",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43529",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43531",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43541",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.1",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-6.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-webkit-6.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.1",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-18",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-6.0-1",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.0-37",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libwebkitgtk-6.0-4",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.50.4-0ubuntu0.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.50.4-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.4-0ubuntu0.22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.34.0-1ubuntu1",
        "2.34.1-1ubuntu1",
        "2.34.2-1ubuntu1",
        "2.34.3-1",
        "2.35.3-1ubuntu1",
        "2.35.90-1ubuntu1",
        "2.36.0-2ubuntu1",
        "2.36.2-0ubuntu0.22.04.1",
        "2.36.3-0ubuntu0.22.04.1",
        "2.36.4-0ubuntu0.22.04.1",
        "2.36.6-0ubuntu0.22.04.1",
        "2.36.7-0ubuntu0.22.04.1",
        "2.36.8-0ubuntu0.22.04.1",
        "2.38.2-0ubuntu0.22.04.2",
        "2.38.3-0ubuntu0.22.04.1",
        "2.38.4-0ubuntu0.22.04.1",
        "2.38.5-0ubuntu0.22.04.1",
        "2.38.6-0ubuntu0.22.04.1",
        "2.40.4-0ubuntu0.22.04.1",
        "2.40.5-0ubuntu0.22.04.1",
        "2.42.1-0ubuntu0.22.04.1",
        "2.42.2-0ubuntu0.22.04.1",
        "2.42.3-0ubuntu0.22.04.1",
        "2.42.4-0ubuntu0.22.04.1",
        "2.42.5-0ubuntu0.22.04.2",
        "2.44.0-0ubuntu0.22.04.1",
        "2.44.2-0ubuntu0.22.04.1",
        "2.44.3-0ubuntu0.22.04.1",
        "2.46.1-0ubuntu0.22.04.3",
        "2.46.3-0ubuntu0.22.04.1",
        "2.46.4-0ubuntu0.22.04.1",
        "2.46.5-0ubuntu0.22.04.1",
        "2.46.6-0ubuntu0.22.04.1",
        "2.48.0-0ubuntu0.22.04.1",
        "2.48.1-0ubuntu0.22.04.1",
        "2.48.3-0ubuntu0.22.04.1",
        "2.48.5-0ubuntu0.22.04.1",
        "2.48.7-0ubuntu0.22.04.2",
        "2.50.1-0ubuntu0.22.04.1",
        "2.50.2-0ubuntu0.22.04.2",
        "2.50.3-0ubuntu0.22.04.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-14174",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43501",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43529",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43531",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43541",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.1",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-6.0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "gir1.2-webkit-6.0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.1",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-6.0-1",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-bin",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libwebkitgtk-6.0-4",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.50.4-0ubuntu0.24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.50.4-0ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.4-0ubuntu0.24.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.42.1-2",
        "2.42.2-1",
        "2.42.3-1",
        "2.42.4-1",
        "2.43.3-1",
        "2.43.3-1build2",
        "2.44.0-2",
        "2.44.2-0ubuntu0.24.04.1",
        "2.44.2-0ubuntu0.24.04.2",
        "2.44.3-0ubuntu0.24.04.1",
        "2.46.1-0ubuntu0.24.04.1",
        "2.46.3-0ubuntu0.24.04.1",
        "2.46.4-0ubuntu0.24.04.1",
        "2.46.5-0ubuntu0.24.04.1",
        "2.46.6-0ubuntu0.24.04.1",
        "2.48.0-0ubuntu0.24.04.1",
        "2.48.1-0ubuntu0.24.04.1",
        "2.48.3-0ubuntu0.24.04.1",
        "2.48.5-0ubuntu0.24.04.1",
        "2.48.7-0ubuntu0.24.04.2",
        "2.50.1-0ubuntu0.24.04.1",
        "2.50.2-0ubuntu0.24.04.2",
        "2.50.3-0ubuntu0.24.04.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-14174",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43501",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43529",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43531",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43535",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43536",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-43541",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:25.10"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gir1.2-javascriptcoregtk-4.1",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "gir1.2-javascriptcoregtk-6.0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "gir1.2-webkit-6.0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "gir1.2-webkit2-4.1",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.0-bin",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-6.0-1",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libjavascriptcoregtk-bin",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libwebkit2gtk-4.1-0",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "libwebkitgtk-6.0-4",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "webkit2gtk-driver",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          },
          {
            "binary_name": "webkitgtk-webdriver",
            "binary_version": "2.50.4-0ubuntu0.25.10.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "webkit2gtk",
        "purl": "pkg:deb/ubuntu/webkit2gtk@2.50.4-0ubuntu0.25.10.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.4-0ubuntu0.25.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.48.1-1ubuntu1",
        "2.48.2-1ubuntu1",
        "2.48.2-1ubuntu2",
        "2.48.3-1ubuntu2",
        "2.48.6-1ubuntu2",
        "2.50.0-2ubuntu1",
        "2.50.0-2ubuntu1.1",
        "2.50.1-0ubuntu0.25.10.1",
        "2.50.2-0ubuntu0.25.10.2",
        "2.50.3-0ubuntu0.25.10.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Several security issues were discovered in the WebKitGTK Web and JavaScript\nengines. If a user were tricked into viewing a malicious website, a remote\nattacker could exploit a variety of issues related to web browser security,\nincluding cross-site scripting attacks, denial of service attacks, and\narbitrary code execution.",
  "id": "USN-7957-1",
  "modified": "2026-04-22T07:37:26Z",
  "published": "2026-01-13T13:57:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7957-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-14174"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-43501"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-43529"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-43531"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-43535"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-43536"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-43541"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "webkit2gtk vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2025-14174",
    "UBUNTU-CVE-2025-43501",
    "UBUNTU-CVE-2025-43529",
    "UBUNTU-CVE-2025-43531",
    "UBUNTU-CVE-2025-43535",
    "UBUNTU-CVE-2025-43536",
    "UBUNTU-CVE-2025-43541"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

UBUNTU-CVE-2025-43529 (CVE-2025-43529)

CVE-2025-43529 (GCVE-0-2025-43529)

USN-7957-1 (UBUNTU-CVE-2025-14174)

Tags

Sightings

Nomenclature

Related by attack behaviour