Вернуться к предупреждениям о безопасности

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

ALSA-2026:96080 updates WebKitGTK on AlmaLinux 8 with a CVE-2026-84359 information-leak fix in Skia (alongside the previously shipped CVE-2026-85049/91747/91733/91740/93387/102325/103629/106379/106399/113106/1183xx series), aggregate CVSS 3.1 (CWE-200 information disclosure). Update with dnf update webkit2gtk3 and restart applications embedding the WebKit view.

High 3.1 CVSS
AlmaLinux 8

Что это значит по лицензии SharedLicense

Information leaks in the Skia rendering layer expose fragments of process memory through crafted web content — lower severity than code execution, but the leaked bytes can contain session tokens or page data.

Type:

security

Severity:

important

Release date:

2026-11-09

Description:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
* chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)
* chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)
* chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)
* chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)
* chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)
* chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)
* chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)
* chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)
* chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)
* chromium-browser: skia: Use after free in Skia (CVE-2026-119271)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 webkit2gtk3-jsc-devel-2.54.2-2.el8_10.aarch64.rpm 2a10ef675e69c618487820415da2baaf2fd4f679f1b732ad3ad2a796bf412f9d
aarch64 webkit2gtk3-devel-2.54.2-2.el8_10.aarch64.rpm c1d15abdf099171cffed404f910721fdaaaf584a0974626284e773be0eda9a7d
aarch64 webkit2gtk3-jsc-2.54.2-2.el8_10.aarch64.rpm cb13c4989fd0df818037890cf8fb319bbd6fc8382b46d1633e3a4a911762ea99
aarch64 webkit2gtk3-2.54.2-2.el8_10.aarch64.rpm d2bc06c13ffa71520d99a9499906371ab4f5ab78f1929a5210a6bdc89ae7baf6
i686 webkit2gtk3-jsc-2.54.2-2.el8_10.i686.rpm 1910fe534fd594f9d26593aa7f238dd08f49ccb740839837f8d38bc0358305ca
i686 webkit2gtk3-devel-2.54.2-2.el8_10.i686.rpm a3037536f1f7f3f944ab3d81697fb547e48669585e38722a1ba46e0c157a64c1
i686 webkit2gtk3-jsc-devel-2.54.2-2.el8_10.i686.rpm b82d53fa06fbc58ee774c531896d9ae9e1eb8b46620cc4bdce30dc478cfd4f42
i686 webkit2gtk3-2.54.2-2.el8_10.i686.rpm e7dc1e74b3dd54517935a24a0999cc1e0ca050fb510522aebadb97adbb7309f8
ppc64le webkit2gtk3-jsc-2.54.2-2.el8_10.ppc64le.rpm 1c0e8a77447872989b7d4f1dcd895d9b76f2b87c5af7cdc9a1de887fc0b52f8d
ppc64le webkit2gtk3-2.54.2-2.el8_10.ppc64le.rpm ae664f20bab86a8269480bab8253a6d159841b3877b4e1807fa313138cd7d2ac
ppc64le webkit2gtk3-jsc-devel-2.54.2-2.el8_10.ppc64le.rpm d28963effbb1df6191ab477a6d202f5e25f15edf962791c5c0e8190cd03a9da9
ppc64le webkit2gtk3-devel-2.54.2-2.el8_10.ppc64le.rpm d5cfc208e8c2a644a76e835f3adf7e4134665cde159967024c6ac18cc1726146
s390x webkit2gtk3-jsc-devel-2.54.2-2.el8_10.s390x.rpm 18346da4aecb7c1c0d9805b92aa8fbb7d55010c6b23a014cd68d7a54a989b777
s390x webkit2gtk3-2.54.2-2.el8_10.s390x.rpm 6c0e9e484778dac17f34e7b6bc378ba640ccacc6779034a1a31bb27a61be52ba
s390x webkit2gtk3-devel-2.54.2-2.el8_10.s390x.rpm a0c34450e40329650f53cc8f34a66d46b16cf3c25830730bcbed2ce40f23aac8
s390x webkit2gtk3-jsc-2.54.2-2.el8_10.s390x.rpm c6600a9d633e928b3c83175e5c0da413083ad060e45d48d8bd2e86cbb39c9dc2
x86_64 webkit2gtk3-jsc-devel-2.54.2-2.el8_10.x86_64.rpm 03d0c9405038c5e0559966765590632b217735815132bbd81cd0fa0e1c7a607f
x86_64 webkit2gtk3-devel-2.54.2-2.el8_10.x86_64.rpm a85750d5b1fbb33b20a9a35958b545f90b61667db2cf50e37f4edf3e4fcd642a
x86_64 webkit2gtk3-jsc-2.54.2-2.el8_10.x86_64.rpm b599055a5b9f64b7db7cd127161cb4d20ea2ba6dab83027d1e26fa7d4c1e3845
x86_64 webkit2gtk3-2.54.2-2.el8_10.x86_64.rpm c4195ea9c6e53ce6a85f80b103f3e7feee2644b30da5c29298d2fee6a7868cbd

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is ALSA-2026:96080?
It is AlmaLinux's WebKitGTK erratum for AlmaLinux 8, fixing CVE-2026-84359 (information leak in Skia) along with the previously shipped CVE-2026-85049, CVE-2026-91747, CVE-2026-91733, CVE-2026-91740, CVE-2026-93387, CVE-2026-102325, CVE-2026-103629, CVE-2026-106379, CVE-2026-106399, CVE-2026-113106 and the CVE-2026-1183xx series. Aggregate CVSS 3.1 (CWE-200).
Who is affected?
AlmaLinux 8 systems running applications that embed WebKitGTK — mail clients, help viewers and lightweight browsers. Headless servers without the package are unaffected.
How do I apply the fix?
Run dnf update webkit2gtk3 and restart any application using the WebKit view so it reloads the patched engine.
Why apply a 3.1-CVSS update?
Because it rides the same package as the previously shipped fixes and information leaks compound — leaked memory fragments often contain the addresses or tokens needed to make the next, more serious exploit reliable.

Источники

Предупреждения о безопасности

Похожие предупреждения

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Thunderbird Security Update — AlmaLinux 8 (ALSA-2026:22643)

2026-11-06

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему