webkitgtk-2.48.2

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

So far I know of at least 6 CVEs here from cross referencing the bug numbers in ​https://support.apple.com/en-us/122719 with bug numbers from commits in the webkitgtk-2.48 branch in WebKit's github repository.

These CVEs are:

• CVE-2025-24223: 8.0 High, memory corruption
• CVE-2025-31215: Unknown, but NVD says "Processing maliciously crafted web content may lead to an unexpected process crash."
• CVE-2025-31206: 4.3 Medium, same as above
• CVE-2025-31257: 4.7 Medium, same as above
• CVE-2025-31204: 8.8 High, memory corruption
• CVE-2025-31205: 6.5 Medium, cross-origin data exfiltration

[Douglas R. Reno]

Official details are now available:

CVE-2025-24223
    Versions affected: WebKitGTK and WPE WebKit before 2.48.2.
    Credit to rheza (@ginggilBesel) and an anonymous researcher.
    Impact: Processing maliciously crafted web content may lead to
    memory corruption. Description: The issue was addressed with
    improved memory handling.
    WebKit Bugzilla: 287577

CVE-2025-31204
    Versions affected: WebKitGTK and WPE WebKit before 2.48.2.
    Credit to Nan Wang (@eternalsakura13).
    Impact: Processing maliciously crafted web content may lead to
    memory corruption. Description: The issue was addressed with
    improved memory handling.
    WebKit Bugzilla: 291506

CVE-2025-31205
    Versions affected: WebKitGTK and WPE WebKit before 2.48.2.
    Credit to Ivan Fratric of Google Project Zero.
    Impact: A malicious website may exfiltrate data cross-origin.
    Description: The issue was addressed with improved checks.
    WebKit Bugzilla: 290992

CVE-2025-31206
    Versions affected: WebKitGTK and WPE WebKit before 2.48.2.
    Credit to an anonymous researcher.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected Safari crash. Description: A type confusion issue was
    addressed with improved state handling.
    WebKit Bugzilla: 290834

CVE-2025-31215
    Versions affected: WebKitGTK and WPE WebKit before 2.48.2.
    Credit to Jiming Wang and Jikai Ren.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected process crash. Description: The issue was addressed with
    improved checks.
    WebKit Bugzilla: 288814

CVE-2025-31257
    Versions affected: WebKitGTK and WPE WebKit before 2.48.2.
    Credit to Juergen Schmied of Lynck GmbH.
    Impact: Processing maliciously crafted web content may lead to an
    unexpected Safari crash. Description: This issue was addressed with
    improved memory handling.
    WebKit Bugzilla: 290985

Note that I had the CVE number above for CVE-2025-24223 incorrect. I will edit that comment.

[Douglas R. Reno]

Already have this tested and working well on x86, will get this in today as well.

[Douglas R. Reno]

What’s new in the WebKitGTK 2.48.2 release?

    Enable CSS Overscroll Behavior by default.
    Change threaded rendering implementation to use Skia API instead of WebCore display 
list that is not thread safe.
    Fix rendering when device scale factor change comes before the web view geometry 
update.
    Fix network process crash on exit.
    Fix the build with ENABLE_RESOURCE_USAGE=OFF.
    Fix several crashes and rendering issues.

[Douglas R. Reno]

Fixed at e98d5e63dbc39a078a88e44a97ca4f117a3ddc0a

[Douglas R. Reno]

SA-12.3-007 issued.