Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ SUSE-SU-2025:1149-1 — webkit2gtk3 (CVE-2024-44192 +2 more)

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

  • CVE-2024-44192: Fixed unexpected process crash due to processing maliciously crafted web content (bsc#1239863)
  • CVE-2024-54467: Fixed information disclosure via data cross-origin exfiltration due to a cookie management issue (bsc#1239864)

Other fixes:

  • Update to version 2.48.0:

+ Move tiles rendering to worker threads when rendering with the

GPU.

+ Fix preserve-3D intersection rendering.

+ Added new function for creating Promise objects to

JavaScripotCore GLib API.

+ The MediaRecorder backend gained WebM support (requires at

least GStreamer 1.24.9) and audio bitrate configuration

support.

+ Fix invalid DPI-aware font size conversion.

+ Bring back support for OpenType-SVG fonts using Skia SVG

module.

+ Add metadata (title and creation/modification date) to the PDF

document generated for printing.

+ Propagate the font’s computed locale to HarfBuzz.

+ The GPU process build is now enabled for WebGL, but the web

process is still used by default. The runtime flag

UseGPUProcessForWebGL can be used to use the GPU process for

WebGL.

+ Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.

  • Disable speech synthesis. It has been disabled until now, and

we don't have flite or spiel in SLE.

  • Add gcc13-PIE to BuildRequires (bsc#1239950).
  • Backport upstream patch to stop using IOChannel in NetworkCache: hopefully fixes

crashes in the network process.

Affected software

SUSE-SU-2025:1149-1 is recorded against 3 packages.

  • webkit2gtk3 (fixed in 2.48.0-150600.12.33.1)
  • webkit2gtk3-soup2 (fixed in 2.48.0-150600.12.33.1)
  • webkit2gtk4 (fixed in 2.48.0-150600.12.33.1)

Timeline and source

Published on 7 April 2025 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.suse.com (Advisory)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2025-04-07
Updated 2026-08-20
Modified 2026-02-04
Fix URL N/A

Affected Packages

Software From version Fixed in
webkit2gtk3 — 2.48.0-150600.12.33.1
webkit2gtk3-soup2 — 2.48.0-150600.12.33.1
webkit2gtk4 — 2.48.0-150600.12.33.1

Similar Threats

Free Vulnerability Check

Is your site affected by SUSE-SU-2025:1149-1?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against SUSE-SU-2025:1149-1 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.