Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2025-3114 (ALAS-2025-3114)

high Nessus Plugin ID 281806

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of webkitgtk4 installed on the remote host is prior to 2.50.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3114 advisory.

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
(CVE-2025-13502)

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser. (CVE-2025-13947)

The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. A website may exfiltrate image data cross-origin. (CVE-2025-43392)

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to memory corruption. (CVE-2025-43419)

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43421)

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43425)

This issue was addressed through improved state management. This issue is fixed in iOS 26.1 and iPadOS 26.1, tvOS 26.1, Safari 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43427)

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.
(CVE-2025-43429)

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43430)

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to memory corruption. (CVE-2025-43431)

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43432)

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
(CVE-2025-43434)

This issue was addressed with improved checks This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43440)

This issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2.
Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2025-43443)

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Processing maliciously crafted web content may lead to an unexpected process crash.
(CVE-2025-43458)

A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to improper memory handling and result in an unexpected process crash. (CVE-2025-43501)

A flaw was found in webkitgtk where when processing a maliciously crafted web content a use-after-free type of weaknesses may be triggered leading to a remote code execution in the client machine.
(CVE-2025-43529)

A flaw was found in WebKitGTK. Processing malicious web content can cause a race condition due to improper state handling and result in an unexpected process crash. (CVE-2025-43531)

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. (CVE-2025-43535)

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash. (CVE-2025-43536)

A flaw was found in WebKitGTK. Processing malicious web content can cause a type confusion issue due to improper state handling and result in an unexpected crash. (CVE-2025-43541)

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. (CVE-2025-66287)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update webkitgtk4' or or 'yum update --advisory ALAS2-2025-3114' to update your system.

Plugin Details

Severity: High

ID: 281806

File Name: al2_ALAS-2025-3114.nasl

Version: 1.1

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 1/5/2026

Updated: 1/5/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-66287

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:webkitgtk4, p-cpe:/a:amazon:linux:webkitgtk4-devel, p-cpe:/a:amazon:linux:webkitgtk4-jsc, p-cpe:/a:amazon:linux:webkitgtk4-jsc-devel

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/5/2026

Vulnerability Publication Date: 9/18/2025

CISA Known Exploited Vulnerability Due Dates: 1/5/2026

Reference Information

CVE: CVE-2025-13502, CVE-2025-13947, CVE-2025-43392, CVE-2025-43419, CVE-2025-43421, CVE-2025-43425, CVE-2025-43427, CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43432, CVE-2025-43434, CVE-2025-43440, CVE-2025-43443, CVE-2025-43458, CVE-2025-43501, CVE-2025-43529, CVE-2025-43531, CVE-2025-43535, CVE-2025-43536, CVE-2025-43541, CVE-2025-66287

IAVA: 2025-A-0901

Detections

Analytics