Vulnerability-Lookup

RHSA-2025:23974

Vulnerability from csaf_opensuse - Published: 2025-12-24 00:00 - Updated: 2026-09-20 11:52

Summary

security update for webkit2gtk3

Severity

Important

Notes

Title of the patch: security update for webkit2gtk3

Description of the patch: This security update provides a functional equivalent of RHSA-2025:23974. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2025:23974.

Patchnames: RHSA-2025:23974

CVE-2025-14174

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2025-43501

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-14174

Threats

Impact moderate

CVE-2025-43529

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-14174

Threats

Impact important

CVE-2025-43531

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-14174

Threats

Impact moderate

CVE-2025-43535

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-14174

Threats

Impact moderate

CVE-2025-43536

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-14174

Threats

Impact moderate

CVE-2025-43541

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-14174

Threats

Impact moderate

References

32 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2025-14174/	self
https://www.suse.com/security/cve/CVE-2025-43501/	self
https://www.suse.com/security/cve/CVE-2025-43529/	self
https://www.suse.com/security/cve/CVE-2025-43531/	self
https://www.suse.com/security/cve/CVE-2025-43535/	self
https://www.suse.com/security/cve/CVE-2025-43536/	self
https://www.suse.com/security/cve/CVE-2025-43541/	self
https://www.suse.com/security/cve/CVE-2025-14174	external
https://bugzilla.suse.com/1254776	external
https://bugzilla.suse.com/1255200	external
https://www.suse.com/security/cve/CVE-2025-43501	external
https://bugzilla.suse.com/1255194	external
https://bugzilla.suse.com/1255200	external
https://www.suse.com/security/cve/CVE-2025-43529	external
https://bugzilla.suse.com/1255198	external
https://bugzilla.suse.com/1255200	external
https://bugzilla.suse.com/1259152	external
https://www.suse.com/security/cve/CVE-2025-43531	external
https://bugzilla.suse.com/1255183	external
https://bugzilla.suse.com/1255200	external
https://www.suse.com/security/cve/CVE-2025-43535	external
https://bugzilla.suse.com/1255195	external
https://bugzilla.suse.com/1255200	external
https://www.suse.com/security/cve/CVE-2025-43536	external
https://bugzilla.suse.com/1255200	external
https://www.suse.com/security/cve/CVE-2025-43541	external
https://bugzilla.suse.com/1255191	external
https://bugzilla.suse.com/1255200	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for webkit2gtk3",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2025:23974.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2025:23974.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2025:23974",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_23974.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2025:23974",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-January/002350.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2025:23974",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-January/002350.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-14174 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-14174/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-43501 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-43501/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-43529 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-43529/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-43531 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-43531/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-43535 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-43535/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-43536 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-43536/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-43541 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-43541/"
      }
    ],
    "title": "security update for webkit2gtk3",
    "tracking": {
      "current_release_date": "2026-09-20T11:52:52Z",
      "generator": {
        "date": "2025-12-24T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2025:23974",
      "initial_release_date": "2025-12-24T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-12-24T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:52:52Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "webkit2gtk3-0:2.50.4-1.el9_6.i686",
                "product": {
                  "name": "webkit2gtk3-0:2.50.4-1.el9_6.i686",
                  "product_id": "webkit2gtk3-0:2.50.4-1.el9_6.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.50.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3@2.50.4-1.el9_6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
                "product": {
                  "name": "webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
                  "product_id": "webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.50.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3-devel@2.50.4-1.el9_6?arch=i686\u0026upstream=webkit2gtk3-0:2.50.4-1.el9_6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
                "product": {
                  "name": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
                  "product_id": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc@2.50.4-1.el9_6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
                "product": {
                  "name": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
                  "product_id": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc-devel@2.50.4-1.el9_6?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
                "product": {
                  "name": "webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
                  "product_id": "webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.50.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3@2.50.4-1.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
                "product": {
                  "name": "webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
                  "product_id": "webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.50.4:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3-devel@2.50.4-1.el9_6?arch=x86_64\u0026upstream=webkit2gtk3-0:2.50.4-1.el9_6.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
                "product": {
                  "name": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
                  "product_id": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc@2.50.4-1.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64",
                "product": {
                  "name": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64",
                  "product_id": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc-devel@2.50.4-1.el9_6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-0:2.50.4-1.el9_6.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686"
        },
        "product_reference": "webkit2gtk3-0:2.50.4-1.el9_6.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-0:2.50.4-1.el9_6.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64"
        },
        "product_reference": "webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-devel-0:2.50.4-1.el9_6.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686"
        },
        "product_reference": "webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64"
        },
        "product_reference": "webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686"
        },
        "product_reference": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64"
        },
        "product_reference": "webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686"
        },
        "product_reference": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        },
        "product_reference": "webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14174",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-14174"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-14174",
          "url": "https://www.suse.com/security/cve/CVE-2025-14174"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254776 for CVE-2025-14174",
          "url": "https://bugzilla.suse.com/1254776"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255200 for CVE-2025-14174",
          "url": "https://bugzilla.suse.com/1255200"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-14174"
    },
    {
      "cve": "CVE-2025-43501",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-43501"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-43501",
          "url": "https://www.suse.com/security/cve/CVE-2025-43501"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255194 for CVE-2025-43501",
          "url": "https://bugzilla.suse.com/1255194"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255200 for CVE-2025-43501",
          "url": "https://bugzilla.suse.com/1255200"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-43501"
    },
    {
      "cve": "CVE-2025-43529",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-43529"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-43529",
          "url": "https://www.suse.com/security/cve/CVE-2025-43529"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255198 for CVE-2025-43529",
          "url": "https://bugzilla.suse.com/1255198"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255200 for CVE-2025-43529",
          "url": "https://bugzilla.suse.com/1255200"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259152 for CVE-2025-43529",
          "url": "https://bugzilla.suse.com/1259152"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-24T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-43529"
    },
    {
      "cve": "CVE-2025-43531",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-43531"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-43531",
          "url": "https://www.suse.com/security/cve/CVE-2025-43531"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255183 for CVE-2025-43531",
          "url": "https://bugzilla.suse.com/1255183"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255200 for CVE-2025-43531",
          "url": "https://bugzilla.suse.com/1255200"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-43531"
    },
    {
      "cve": "CVE-2025-43535",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-43535"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-43535",
          "url": "https://www.suse.com/security/cve/CVE-2025-43535"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255195 for CVE-2025-43535",
          "url": "https://bugzilla.suse.com/1255195"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255200 for CVE-2025-43535",
          "url": "https://bugzilla.suse.com/1255200"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-43535"
    },
    {
      "cve": "CVE-2025-43536",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-43536"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-43536",
          "url": "https://www.suse.com/security/cve/CVE-2025-43536"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255200 for CVE-2025-43536",
          "url": "https://bugzilla.suse.com/1255200"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-43536"
    },
    {
      "cve": "CVE-2025-43541",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-43541"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-43541",
          "url": "https://www.suse.com/security/cve/CVE-2025-43541"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255191 for CVE-2025-43541",
          "url": "https://bugzilla.suse.com/1255191"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255200 for CVE-2025-43541",
          "url": "https://bugzilla.suse.com/1255200"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.50.4-1.el9_6.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.50.4-1.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-24T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-43541"
    }
  ]
}

CVE-2025-14174 (GCVE-0-2025-14174)

Vulnerability from cvelistv5 – Published: 2025-12-12 19:20 – Updated: 2026-09-21 12:59

Summary

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-16 04:55 UTC

CWE

Out of bounds memory access
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

Chrome Google root

References

4 references

URL	Tags
https://chromereleases.googleblog.com/2025/12/sta…
https://issues.chromium.org/issues/466192044
https://learn.microsoft.com/en-us/deployedge/micr…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 143.0.7499.110 , < 143.0.7499.110 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14174",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T04:55:55.101177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-12-12",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14174"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T12:59:56.866Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14174"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "143.0.7499.110",
              "status": "affected",
              "version": "143.0.7499.110",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out of bounds memory access",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-12T19:20:41.809Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html"
        },
        {
          "url": "https://issues.chromium.org/issues/466192044"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2025-14174",
    "datePublished": "2025-12-12T19:20:41.809Z",
    "dateReserved": "2025-12-05T22:14:20.036Z",
    "dateUpdated": "2026-09-21T12:59:56.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43501 (GCVE-0-2025-43501)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:46 – Updated: 2026-04-02 18:09

Summary

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-19 04:55 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected process crash
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

apple mitre root

References

5 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125885
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/125892

Impacted products

4 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.3 (custom) Affected: 0 , < 26.2 (custom)
Apple	macOS	Affected: 0 , < 26.2 (custom)
Apple	visionOS	Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43501",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T04:55:32.311931Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:07:30.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:09:14.942Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/125885"
        },
        {
          "url": "https://support.apple.com/en-us/125886"
        },
        {
          "url": "https://support.apple.com/en-us/125891"
        },
        {
          "url": "https://support.apple.com/en-us/125892"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43501",
    "datePublished": "2025-12-17T20:46:30.548Z",
    "dateReserved": "2025-04-16T15:27:21.192Z",
    "dateUpdated": "2026-04-02T18:09:14.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43529 (GCVE-0-2025-43529)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:46 – Updated: 2026-09-21 16:46

Summary

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-18 04:55 UTC

CWE

Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
CWE-416 - Use After Free

Assigner

apple mitre root

References

8 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125885
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125889
https://support.apple.com/en-us/125890
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/125892
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.3 (custom) Affected: 0 , < 26.2 (custom)
Apple	macOS	Affected: 0 , < 26.2 (custom)
Apple	tvOS	Affected: 0 , < 26.2 (custom)
Apple	visionOS	Affected: 0 , < 26.2 (custom)
Apple	watchOS	Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43529",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-18T04:55:16.426232Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-12-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:46:54.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:18:20.608Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/125885"
        },
        {
          "url": "https://support.apple.com/en-us/125886"
        },
        {
          "url": "https://support.apple.com/en-us/125889"
        },
        {
          "url": "https://support.apple.com/en-us/125890"
        },
        {
          "url": "https://support.apple.com/en-us/125891"
        },
        {
          "url": "https://support.apple.com/en-us/125892"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43529",
    "datePublished": "2025-12-17T20:46:55.691Z",
    "dateReserved": "2025-04-16T15:27:21.197Z",
    "dateUpdated": "2026-09-21T16:46:54.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43531 (GCVE-0-2025-43531)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:46 – Updated: 2026-04-02 18:13

Summary

A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-17 21:10 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected process crash
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

apple mitre root

References

7 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125885
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125889
https://support.apple.com/en-us/125890
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/125892

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.3 (custom) Affected: 0 , < 26.2 (custom)
Apple	macOS	Affected: 0 , < 26.2 (custom)
Apple	tvOS	Affected: 0 , < 26.2 (custom)
Apple	visionOS	Affected: 0 , < 26.2 (custom)
Apple	watchOS	Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 3.1,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43531",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:10:04.613113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-07T15:13:48.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:13:55.030Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/125885"
        },
        {
          "url": "https://support.apple.com/en-us/125886"
        },
        {
          "url": "https://support.apple.com/en-us/125889"
        },
        {
          "url": "https://support.apple.com/en-us/125890"
        },
        {
          "url": "https://support.apple.com/en-us/125891"
        },
        {
          "url": "https://support.apple.com/en-us/125892"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43531",
    "datePublished": "2025-12-17T20:46:41.109Z",
    "dateReserved": "2025-04-16T15:27:21.197Z",
    "dateUpdated": "2026-04-02T18:13:55.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43535 (GCVE-0-2025-43535)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:47 – Updated: 2026-04-02 18:23

Summary

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-17 21:33 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected process crash
CWE-noinfo Not enough information

Assigner

apple mitre root

References

5 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125885
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/125892

Impacted products

4 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.3 (custom) Affected: 0 , < 26.2 (custom)
Apple	macOS	Affected: 0 , < 26.2 (custom)
Apple	visionOS	Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43535",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:33:55.486677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T21:34:15.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:23:38.768Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/125885"
        },
        {
          "url": "https://support.apple.com/en-us/125886"
        },
        {
          "url": "https://support.apple.com/en-us/125891"
        },
        {
          "url": "https://support.apple.com/en-us/125892"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43535",
    "datePublished": "2025-12-17T20:47:09.217Z",
    "dateReserved": "2025-04-16T15:27:21.198Z",
    "dateUpdated": "2026-04-02T18:23:38.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43536 (GCVE-0-2025-43536)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:46 – Updated: 2026-04-02 18:12

Summary

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-17 21:09 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected process crash
CWE-416 - Use After Free

Assigner

apple mitre root

References

4 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125885
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125892

Impacted products

3 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.3 (custom) Affected: 0 , < 26.2 (custom)
Apple	macOS	Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43536",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:09:31.144207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T21:09:50.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:12:18.179Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/125885"
        },
        {
          "url": "https://support.apple.com/en-us/125886"
        },
        {
          "url": "https://support.apple.com/en-us/125892"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43536",
    "datePublished": "2025-12-17T20:46:37.012Z",
    "dateReserved": "2025-04-16T15:27:21.198Z",
    "dateUpdated": "2026-04-02T18:12:18.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43541 (GCVE-0-2025-43541)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:46 – Updated: 2026-04-02 18:09

Summary

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-19 04:55 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected Safari crash
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

apple mitre root

References

5 references

URL	Tags
https://support.apple.com/en-us/125884
https://support.apple.com/en-us/125885
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125891
https://support.apple.com/en-us/125892

Impacted products

4 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.7.3 (custom) Affected: 0 , < 26.2 (custom)
Apple	macOS	Affected: 0 , < 26.2 (custom)
Apple	visionOS	Affected: 0 , < 26.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43541",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T04:55:33.448534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-843",
                "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:07:30.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected Safari crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:09:40.186Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125884"
        },
        {
          "url": "https://support.apple.com/en-us/125885"
        },
        {
          "url": "https://support.apple.com/en-us/125886"
        },
        {
          "url": "https://support.apple.com/en-us/125891"
        },
        {
          "url": "https://support.apple.com/en-us/125892"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43541",
    "datePublished": "2025-12-17T20:46:31.670Z",
    "dateReserved": "2025-04-16T15:27:21.198Z",
    "dateUpdated": "2026-04-02T18:09:40.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:23974

CVE-2025-14174 (GCVE-0-2025-14174)

CVE-2025-43501 (GCVE-0-2025-43501)

CVE-2025-43529 (GCVE-0-2025-43529)

CVE-2025-43531 (GCVE-0-2025-43531)

CVE-2025-43535 (GCVE-0-2025-43535)

CVE-2025-43536 (GCVE-0-2025-43536)

CVE-2025-43541 (GCVE-0-2025-43541)

Tags

Sightings

Nomenclature

Related by attack behaviour