[CLSA-2026:1791973636] webkit2gtk3: Fix of 62 CVEs
Type:
security
Severity:
Important
Release date:
2026-10-14 10:28:22 UTC
Description:
- Rebase to webkitgtk 2.54.0 (WebKitGTK Security Advisory WSA-2026-0006), aligning with the release RHEL 9 ships (webkit2gtk3-2.54.0-1.el9_8, RHSA-2026:69098). - Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from c9s 2.54.0-2 and reverts 317619@main, which aborts Eclipse/SWT applications on a RELEASE_ASSERT in initializeMainThread. - Drop fix-renderflexbox-typename.patch (was Patch17); the code it patched is gone on 2.54.0. - Build with gcc-toolset-14 (GCC 14) instead of gcc-toolset-12; GCC 12 cannot compile 2.54.0 (ANGLE ResourceMap static_assert, LayoutRect constexpr). - Backport the GStreamerCommon.h include from upstream 2.54.1; GCC resolves the symlinked WebCore private headers to their real path, so the quoted include is not found when building the PCH. - Drop the vendored Skia backports for CVE-2026-5870, CVE-2026-7920, CVE-2026-7923, CVE-2026-10009 and CVE-2026-11663 (was Patch20..Patch24); the Skia snapshot bundled with 2.54.0 already includes them. - CVEs resolved by this rebase (62 total): CVE-2026-3538, CVE-2026-3909, CVE-2026-4460, CVE-2026-6298, CVE-2026-6364, CVE-2026-7353, CVE-2026-7949, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983, CVE-2026-9998, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985, CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099, CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11675, CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-2026-14427, CVE-2026-15766, CVE-2026-16417, CVE-2026-17702, CVE-2026-17745, CVE-2026-17757, CVE-2026-17914, CVE-2026-19160, CVE-2026-19161, CVE-2026-19176, CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64753, CVE-2026-64757, CVE-2026-64778, CVE-2026-64779, CVE-2026-64782, CVE-2026-64783, CVE-2026-64784, CVE-2026-65332, CVE-2026-65336, CVE-2026-65337, CVE-2026-65341, CVE-2026-65351, CVE-2026-76041, CVE-2026-78376, CVE-2026-78914, CVE-2026-79020, CVE-2026-79112, CVE-2026-79144, CVE-2026-79147, CVE-2026-83596, CVE-2026-84359, CVE-2026-84635, CVE-2026-85049
CVEs fixed:
Updated packages:
  • webkit2gtk3-2.54.0-1.el9.tuxcare.els12.aarch64.rpm
    sha:49905d2725a8793cfe0c9ecf78948dab9fae872455bb3db73c2f83cd15eb071e
  • webkit2gtk3-2.54.0-1.el9.tuxcare.els12.x86_64.rpm
    sha:86137f5632ee668cbc9eae2125a251d61879c9834eca9a5b84f986e6bd3c4cf8
  • webkit2gtk3-devel-2.54.0-1.el9.tuxcare.els12.aarch64.rpm
    sha:67d09f2ddf4ff8a8c53e2eecdd50b9cd8052b31f864ac9914b6908dde37dd6f7
  • webkit2gtk3-devel-2.54.0-1.el9.tuxcare.els12.x86_64.rpm
    sha:84375729b6f188f14e6bf3f62c5664bba88d00d2b85145adcfbd2330e484f768
  • webkit2gtk3-jsc-2.54.0-1.el9.tuxcare.els12.aarch64.rpm
    sha:7a5ed45585557d1f65171cb2eb78ed786d30714d7e812844af9f1f5c0539e2cb
  • webkit2gtk3-jsc-2.54.0-1.el9.tuxcare.els12.x86_64.rpm
    sha:eb0725485bde20bb4765b46d396d9bd481a830e5daf4f88950a20bd606dcb78b
  • webkit2gtk3-jsc-devel-2.54.0-1.el9.tuxcare.els12.aarch64.rpm
    sha:a7105e1663da36edaec79d05cced2f41c5ba796dd1428d92a06beece293e831e
  • webkit2gtk3-jsc-devel-2.54.0-1.el9.tuxcare.els12.x86_64.rpm
    sha:22017f069c39d60aad127f13936a7396d32f7f10446e19b56a4d894fc0c2960f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.