SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:3338-1)

high Nessus Plugin ID 330550

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3338-1 advisory.

- CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution (bsc#1271638).
- CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43663: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43676: out-of-bounds access when processing web content can lead to an unexpected Safari crash (bsc#1271638).
- CVE-2026-43699: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43701: malicious website can process restricted web content outside the sandbox (bsc#1271638).
- CVE-2026-43705: type confusion issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43707: memory corruption issue when processing web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43712: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43713: visiting a website can leak sensitive data due to a permissions issue (bsc#1271638).
- CVE-2026-43715: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43716: maliciously crafted web content can lead to an unexpected Safari crash (bsc#1271638).
- CVE-2026-43720: use-after-free issue when processing web content can lead to an unexpected Safari crash (bsc#1271638).
- CVE-2026-43721: malicious website can silently hijack clipboard data (bsc#1271638).
- CVE-2026-43725: unvalidated input can allow a malicious website to process restricted web content outside the sandbox (bsc#1271638).
- CVE-2026-43726: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43727: use-after-free issue when processing web content can lead to an unexpected Safari crash (bsc#1271638).
- CVE-2026-43731: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43732: path handling issue when processing web content can disclose sensitive user information (bsc#1271638).
- CVE-2026-43734: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43740: maliciously crafted web content can result in the disclosure of process memory (bsc#1271638).
- CVE-2026-43742: use-after-free issue when processing web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43745: out-of-bounds write issue when processing web content can lead to an unexpected Safari crash (bsc#1271638).

Changes for webkit2gtk3:

- Update to version 2.52.5:

* Fire scrollend event for instant programmatic scrolls.
* Increase network idle connection timeout to 115 seconds.
* Add User-Agent quirk for HBO Max.
* Fix the build with system malloc.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 330550

File Name: suse_SU-2026-3338-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 7/29/2026

Updated: 7/29/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

Percentile: 99.86

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-4367

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18, p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_1-0, p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-6_0-1, p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37, p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_1-0, p-cpe:/a:novell:suse_linux:libwebkitgtk-6_0-4, p-cpe:/a:novell:suse_linux:typelib-1_0-javascriptcore-4_0, p-cpe:/a:novell:suse_linux:typelib-1_0-javascriptcore-4_1, p-cpe:/a:novell:suse_linux:typelib-1_0-javascriptcore-6_0, p-cpe:/a:novell:suse_linux:typelib-1_0-webkit-6_0, p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2-4_0, p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2-4_1, p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2webextension-4_0, p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2webextension-4_1, p-cpe:/a:novell:suse_linux:typelib-1_0-webkitwebprocessextension-6_0, p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles, p-cpe:/a:novell:suse_linux:webkit2gtk-4_1-injected-bundles, p-cpe:/a:novell:suse_linux:webkit2gtk3-devel, p-cpe:/a:novell:suse_linux:webkit2gtk3-soup2-devel, p-cpe:/a:novell:suse_linux:webkit2gtk4-devel, p-cpe:/a:novell:suse_linux:webkitgtk-4.0-lang, p-cpe:/a:novell:suse_linux:webkitgtk-4.1-lang, p-cpe:/a:novell:suse_linux:webkitgtk-6.0-lang, p-cpe:/a:novell:suse_linux:webkitgtk-6_0-injected-bundles

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/28/2026

Vulnerability Publication Date: 5/7/2024

Reference Information

CVE: CVE-2024-4367, CVE-2026-39872, CVE-2026-43663, CVE-2026-43676, CVE-2026-43699, CVE-2026-43701, CVE-2026-43705, CVE-2026-43707, CVE-2026-43712, CVE-2026-43713, CVE-2026-43715, CVE-2026-43716, CVE-2026-43720, CVE-2026-43721, CVE-2026-43725, CVE-2026-43726, CVE-2026-43727, CVE-2026-43731, CVE-2026-43732, CVE-2026-43734, CVE-2026-43740, CVE-2026-43742, CVE-2026-43745

SuSE: SUSE-SU-2026:3338-1

Detections

Analytics