A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0998 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2025-13502:
    A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer     underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

    CVE-2025-13947:
    A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that     can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where     WebKitGTK does not verify that drag operations originate from outside the browser.

    CVE-2025-43392:
    The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. A website may exfiltrate image data cross-origin.

    CVE-2025-43421:
    Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in iOS 26.1 and     iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash.

    CVE-2025-43425:
    The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1,     watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to     an unexpected process crash.

    CVE-2025-43427:
    This issue was addressed through improved state management. This issue is fixed in iOS 26.1 and iPadOS     26.1, tvOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash.

    CVE-2025-43429:
    A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and     iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-43430:
    This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS     26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may     lead to an unexpected process crash.

    CVE-2025-43431:
    The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. Processing maliciously crafted web content may lead to memory corruption.

    CVE-2025-43432:
    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1,     visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web     content may lead to an unexpected process crash.

    CVE-2025-43434:
    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.2     and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

    CVE-2025-43440:
    This issue was addressed with improved checks This issue is fixed in Safari 26.1, visionOS 26.1, watchOS     26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash.

    CVE-2025-43443:
    This issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2.
    Processing maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-43458:
    This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-66287:
    A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due     to improper memory handling.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:1000 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-13502:
    A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer     underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

    CVE-2025-13947:
    A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that     can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where     WebKitGTK does not verify that drag operations originate from outside the browser.

    CVE-2025-43392:
    The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. A website may exfiltrate image data cross-origin.

    CVE-2025-43421:
    Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in iOS 26.1 and     iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash.

    CVE-2025-43425:
    The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1,     watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to     an unexpected process crash.

    CVE-2025-43427:
    This issue was addressed through improved state management. This issue is fixed in iOS 26.1 and iPadOS     26.1, tvOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash.

    CVE-2025-43429:
    A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and     iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-43430:
    This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS     26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may     lead to an unexpected process crash.

    CVE-2025-43431:
    The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. Processing maliciously crafted web content may lead to memory corruption.

    CVE-2025-43432:
    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1,     visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web     content may lead to an unexpected process crash.

    CVE-2025-43434:
    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.2     and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

    CVE-2025-43440:
    This issue was addressed with improved checks This issue is fixed in Safari 26.1, visionOS 26.1, watchOS     26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash.

    CVE-2025-43443:
    This issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2.
    Processing maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-43458:
    This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.

    CVE-2025-66287:
    A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due     to improper memory handling.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11554:21 advisory.

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
      * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)
      * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11507:20 advisory.

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
      * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)
      * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0021-1 advisory.

    Update to version 2.50.4.

    Security issues fixed:

    - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead     to a       UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
    - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to     a lack of       verification of the origins of drag operations (bsc#1254473).
    - CVE-2025-14174: processing maliciously crafted web content may lead to memory corruption due to improper     validation       (bsc#1255497).
    - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling     (bsc#1254165).
    - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due     to enabled       array allocation sinking (bsc#1254167).
    - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254168).
    - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254169).
    - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1254174).
    - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254172).
    - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254170).
    - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254171).
    - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254179).
    - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254177).
    - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254176).
    - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254498).
    - CVE-2025-43501: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1255194).
    - CVE-2025-43529: processing maliciously crafted web content may lead to arbitrary code execution due to a       use-after-free issue (bsc#1255198).
    - CVE-2025-43531: processing maliciously crafted web content may lead to an unexpected process crash due     to a race       condition (bsc#1255183).
    - CVE-2025-43535: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1255195).
    - CVE-2025-43536: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1255200).
    - CVE-2025-43541: processing maliciously crafted web content may lead to an unexpected process crash due     to type       confusion (bsc#1255191).
    - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254509).

    Other issues fixed and changes:

    - Version 2.50.4:
      * Correctly handle the program name passed to the sleep disabler.
      * Ensure GStreamer is initialized before using the Quirks.
      * Fix several crashes and rendering issues.

    - Version 2.50.3:
      * Fix seeking and looping of media elements that set the 'loop' property.
      * Fix several crashes and rendering issues.

    - Version 2.50.2:
      * Prevent unsafe URI schemes from participating in media playback.
      * Make jsc_value_array_buffer_get_data() function introspectable.
      * Fix logging in to Google accounts that have a WebAuthn second factor configured.
      * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
      * Fix rendering gradiants that use the CSS hue interpolation method.
      * Fix pasting image data from the clipboard.
      * Fix font-family selection when the font name contains spaces.
      * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc.
      * Fix capturing canvas snapshots in the Web Inspector.
      * Fix several crashes and rendering issues.

    - Fix a11y regression where AT-SPI roles were mapped incorrectly.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of webkitgtk4 installed on the remote host is prior to 2.50.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3114 advisory.

    A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer     underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
    (CVE-2025-13502)

    A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that     can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where     WebKitGTK does not verify that drag operations originate from outside the browser. (CVE-2025-13947)

    The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. A website may exfiltrate image data cross-origin. (CVE-2025-43392)

    The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS     26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to memory     corruption. (CVE-2025-43419)

    Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in iOS 26.1 and     iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash. (CVE-2025-43421)

    The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1,     watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to     an unexpected process crash. (CVE-2025-43425)

    This issue was addressed through improved state management. This issue is fixed in iOS 26.1 and iPadOS     26.1, tvOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash. (CVE-2025-43427)

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and     iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.
    (CVE-2025-43429)

    This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS     26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may     lead to an unexpected process crash. (CVE-2025-43430)

    The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. Processing maliciously crafted web content may lead to memory corruption. (CVE-2025-43431)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1,     visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web     content may lead to an unexpected process crash. (CVE-2025-43432)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.2     and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
    (CVE-2025-43434)

    This issue was addressed with improved checks This issue is fixed in Safari 26.1, visionOS 26.1, watchOS     26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an     unexpected process crash. (CVE-2025-43440)

    This issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2.
    Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43443)

    This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS     18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.
    (CVE-2025-43458)

    A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to     improper memory handling and result in an unexpected process crash. (CVE-2025-43501)

    A flaw was found in webkitgtk where when processing a maliciously crafted web content a use-after-free     type of weaknesses may be triggered leading to a remote code execution in the client machine.
    (CVE-2025-43529)

    A flaw was found in WebKitGTK. Processing malicious web content can cause a race condition due to improper     state handling and result in an unexpected process crash. (CVE-2025-43531)

    A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due     to improper memory handling. (CVE-2025-43535)

    A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to     improper memory management and result in an unexpected process crash. (CVE-2025-43536)

    A flaw was found in WebKitGTK. Processing malicious web content can cause a type confusion issue due to     improper state handling and result in an unexpected crash. (CVE-2025-43541)

    A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due     to improper memory handling. (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23742 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23743 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23591 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23583 advisory.

    WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages     provide WebKitGTK+ for GTK+ 3.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4423-1 advisory.

    Update to version 2.50.3.

    Security issues fixed:

    - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead     to a       UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
    - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to     a lack of       verification of the origins of drag operations (bsc#1254473).
    - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling     (bsc#1254165).
    - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due     to enabled       array allocation sinking (bsc#1254167).
    - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254168).
    - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254169).
    - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1254174).
    - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254172).
    - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254170).
    - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254171).
    - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254179).
    - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254177).
    - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254176).
    - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254498).
    - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254509).

    Other issues fixed and changes:

    - Version 2.50.3:
      * Fix seeking and looping of media elements that set the 'loop' property.
      * Fix several crashes and rendering issues.

    - Version 2.50.2:
      * Prevent unsafe URI schemes from participating in media playback.
      * Make jsc_value_array_buffer_get_data() function introspectable.
      * Fix logging in to Google accounts that have a WebAuthn second factor configured.
      * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
      * Fix rendering gradiants that use the CSS hue interpolation method.
      * Fix pasting image data from the clipboard.
      * Fix font-family selection when the font name contains spaces.
      * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc.
      * Fix capturing canvas snapshots in the Web Inspector.
      * Fix several crashes and rendering issues.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23452 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23433 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23451 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23434 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4416-1 advisory.

    Update to version 2.50.3.

    Security issues fixed:

    - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead     to a       UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
    - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to     a lack of       verification of the origins of drag operations (bsc#1254473).
    - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling     (bsc#1254165).
    - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due     to enabled       array allocation sinking (bsc#1254167).
    - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254168).
    - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254169).
    - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due     to a buffer       overflow issue (bsc#1254174).
    - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254172).
    - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper     memory       handling (bsc#1254170).
    - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254171).
    - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due     to a       use-after-free issue (bsc#1254179).
    - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254177).
    - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due     to missing       checks (bsc#1254176).
    - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due     to issues with       state management (bsc#1254498).
    - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due     to improper       memory handling (bsc#1254509).

    Other issues fixed and changes:

    - Version 2.50.3:
      * Fix seeking and looping of media elements that set the 'loop' property.
      * Fix several crashes and rendering issues.
    - Version 2.50.2:
      * Prevent unsafe URI schemes from participating in media playback.
      * Make jsc_value_array_buffer_get_data() function introspectable.
      * Fix logging in to Google accounts that have a WebAuthn second factor configured.
      * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
      * Fix rendering gradiants that use the CSS hue interpolation method.
      * Fix pasting image data from the clipboard.
      * Fix font-family selection when the font name contains spaces.
      * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc.
      * Fix capturing canvas snapshots in the Web Inspector.
      * Fix several crashes and rendering issues.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23110 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:22789 advisory.

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
      * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)
      * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:22790 advisory.

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:22789 advisory.

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:22790 advisory.

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
      * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)
      * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-22790 advisory.

    [2.50.3-1]
    - Update to 2.50.3

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-22789 advisory.

    [2.50.3-1]
    - Update to 2.50.3

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22790 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22789 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS     (CVE-2025-13502)

    * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43425)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43427)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43429)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43430)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43432)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-43434)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43440)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43443)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43421)

    * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-43458)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-66287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4fc934f283 advisory.

     * Prevent unsafe URI schemes from participating in media playback.
     * Make jsc_value_array_buffer_get_data() function introspectable.
     * Fix logging in to Google accounts that have a WebAuthn second factor configured.
     * Fix loading webkit://gpu when there are no threads configured for GPU rendering.
     * Fix rendering gradients that use the CSS hue interpolation method.
     * Fix pasting image data from the clipboard.
     * Fix font-family selection when the font name contains spaces.
     * Fix capturing canvas snapshots in the Web Inspector.
     * Fix several crashes and rendering issues.
     * 2.50.2 CVE fixes: CVE-2023-43000, CVE-2025-43392, CVE-2025-43419, CVE-2025-43425, CVE-2025-43427,     CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43432, CVE-2025-43434, CVE-2025-43440,     CVE-2025-43443, CVE-2025-43480
     * This Fedora update additionally fixes CVE-2025-43421 via a downstream patch


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer     underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
    (CVE-2025-13502)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
284654	TencentOS Server 2: webkitgtk4 (TSSA-2025:0998)	Nessus	Tencent Local Security Checks	high
284634	TencentOS Server 3: webkit2gtk3 (TSSA-2025:1000)	Nessus	Tencent Local Security Checks	high
283257	MiracleLinux 9 : webkit2gtk3-2.50.3-1.el9_7 (AXSA:2025-11554:21)	Nessus	Miracle Linux Local Security Checks	high
283167	MiracleLinux 8 : webkit2gtk3-2.50.3-1.el8_10.ML.1 (AXSA:2025-11507:20)	Nessus	Miracle Linux Local Security Checks	high
281839	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : webkit2gtk3 (SUSE-SU-2026:0021-1)	Nessus	SuSE Local Security Checks	high
281806	Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2025-3114 (ALAS-2025-3114)	Nessus	Amazon Linux Local Security Checks	high
279523	RHEL 8 : webkit2gtk3 (RHSA-2025:23742)	Nessus	Red Hat Local Security Checks	high
279515	RHEL 8 : webkit2gtk3 (RHSA-2025:23743)	Nessus	Red Hat Local Security Checks	high
279090	RHEL 9 : webkit2gtk3 (RHSA-2025:23591)	Nessus	Red Hat Local Security Checks	high
279088	RHEL 7 : webkitgtk4 (RHSA-2025:23583)	Nessus	Red Hat Local Security Checks	high
279065	SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2025:4423-1)	Nessus	SuSE Local Security Checks	high
278998	RHEL 9 : webkit2gtk3 (RHSA-2025:23452)	Nessus	Red Hat Local Security Checks	high
278996	RHEL 8 : webkit2gtk3 (RHSA-2025:23433)	Nessus	Red Hat Local Security Checks	high
278953	RHEL 9 : webkit2gtk3 (RHSA-2025:23451)	Nessus	Red Hat Local Security Checks	high
278952	RHEL 8 : webkit2gtk3 (RHSA-2025:23434)	Nessus	Red Hat Local Security Checks	high
278944	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2025:4416-1)	Nessus	SuSE Local Security Checks	high
278299	RHEL 9 : webkit2gtk3 (RHSA-2025:23110)	Nessus	Red Hat Local Security Checks	high
277925	AlmaLinux 8 : webkit2gtk3 (ALSA-2025:22789)	Nessus	Alma Linux Local Security Checks	high
277885	RockyLinux 9 : webkit2gtk3 (RLSA-2025:22790)	Nessus	Rocky Linux Local Security Checks	high
277884	RockyLinux 8 : webkit2gtk3 (RLSA-2025:22789)	Nessus	Rocky Linux Local Security Checks	high
277842	AlmaLinux 9 : webkit2gtk3 (ALSA-2025:22790)	Nessus	Alma Linux Local Security Checks	high
277789	Oracle Linux 9 : webkit2gtk3 (ELSA-2025-22790)	Nessus	Oracle Linux Local Security Checks	high
277788	Oracle Linux 8 : webkit2gtk3 (ELSA-2025-22789)	Nessus	Oracle Linux Local Security Checks	high
277612	RHEL 9 : webkit2gtk3 (RHSA-2025:22790)	Nessus	Red Hat Local Security Checks	high
277608	RHEL 8 : webkit2gtk3 (RHSA-2025:22789)	Nessus	Red Hat Local Security Checks	high
277026	Fedora 42 : webkitgtk (2025-4fc934f283)	Nessus	Fedora Local Security Checks	critical
276745	Linux Distros Unpatched Vulnerability : CVE-2025-13502	Nessus	Misc.	high

Detections

Analytics

CVE-2025-13502

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high