From d87a2dea29c7be0a00408fd8bc20bba0862b83e2 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sat, 17 May 2025 22:24:17 +0200 Subject: [PATCH] package/webkitgtk: security bump to version 2.48.2 Fixes the following security issues: CVE-2025-24223 Versions affected: WebKitGTK and WPE WebKit before 2.48.2. Credit to rheza (@ginggilBesel) and an anonymous researcher. Impact: Processing maliciously crafted web content may lead to memory corruption. Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 287577 CVE-2025-31204 Versions affected: WebKitGTK and WPE WebKit before 2.48.2. Credit to Nan Wang (@eternalsakura13). Impact: Processing maliciously crafted web content may lead to memory corruption. Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 291506 CVE-2025-31205 Versions affected: WebKitGTK and WPE WebKit before 2.48.2. Credit to Ivan Fratric of Google Project Zero. Impact: A malicious website may exfiltrate data cross-origin. Description: The issue was addressed with improved checks. WebKit Bugzilla: 290992 CVE-2025-31206 Versions affected: WebKitGTK and WPE WebKit before 2.48.2. Credit to an anonymous researcher. Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A type confusion issue was addressed with improved state handling. WebKit Bugzilla: 290834 CVE-2025-31215 Versions affected: WebKitGTK and WPE WebKit before 2.48.2. Credit to Jiming Wang and Jikai Ren. Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved checks. WebKit Bugzilla: 288814 CVE-2025-31257 Versions affected: WebKitGTK and WPE WebKit before 2.48.2. Credit to Juergen Schmied of Lynck GmbH. Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: This issue was addressed with improved memory handling. WebKit Bugzilla: 290985 https://webkitgtk.org/security/WSA-2025-0004.html Signed-off-by: Peter Korsgaard Acked-by: Adrian Perez de Castro Signed-off-by: Peter Korsgaard (cherry picked from commit 7a09fcf7c69ca3f8a3c47ae60d0f44216968e6a9) Signed-off-by: Thomas Perale --- package/webkitgtk/webkitgtk.hash | 6 +++--- package/webkitgtk/webkitgtk.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/webkitgtk/webkitgtk.hash b/package/webkitgtk/webkitgtk.hash index fd9420bad9..82b5cb4651 100644 --- a/package/webkitgtk/webkitgtk.hash +++ b/package/webkitgtk/webkitgtk.hash @@ -1,6 +1,6 @@ -# From https://www.webkitgtk.org/releases/webkitgtk-2.48.1.tar.xz.sums -sha1 f7939f920f92f6b1395b8573f069d3fb9c085b3f webkitgtk-2.48.1.tar.xz -sha256 98efdf21c4cdca0fe0b73ab5a8cb52093b5aa52d9b1b016a93f71dbfa1eb258f webkitgtk-2.48.1.tar.xz +# From https://www.webkitgtk.org/releases/webkitgtk-2.48.2.tar.xz.sums +sha1 e1a216588ad5eaf71b548b035699319f74cbd8da webkitgtk-2.48.2.tar.xz +sha256 ec58f6dfc25d3b360388e192f865068d69aab09b4d7df021f90e314d2fa54f37 webkitgtk-2.48.2.tar.xz # Hashes for license files: sha256 0b5d3a7cc325942567373b0ecd757d07c132e0ebd7c97bfc63f7e1a76094edb4 Source/WebCore/LICENSE-APPLE diff --git a/package/webkitgtk/webkitgtk.mk b/package/webkitgtk/webkitgtk.mk index d139108126..b24527f7ce 100644 --- a/package/webkitgtk/webkitgtk.mk +++ b/package/webkitgtk/webkitgtk.mk @@ -4,7 +4,7 @@ # ################################################################################ -WEBKITGTK_VERSION = 2.48.1 +WEBKITGTK_VERSION = 2.48.2 WEBKITGTK_SITE = https://www.webkitgtk.org/releases WEBKITGTK_SOURCE = webkitgtk-$(WEBKITGTK_VERSION).tar.xz WEBKITGTK_INSTALL_STAGING = YES