This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] WebKitGTK and WPE WebKit fix 3 vulnerabilities
WebKitGTK and WPE WebKit version 2.48.0 fix 3 vulnerabilities [1][2], one of which is actively exploited [3]. Apple operating systems and their latest fixed versions: macOS - 15.3.2 [4], iOS and iPadOS - 18.3.2 [5], Safari - 18.3.1 [6], visionOS - 2.3.2 [7], tvOS - 18.3.1 [8], watchOS - 11.3.1 [9]. Individual Debian releases and fixed product versions [10][11][12]: bookworm (security) - 2.48.0-1~deb12u1 (package webkit2gtk), trixie, sid - 2.48.0-1 (packages webkit2gtk and wpewebkit). For CVE-2025-24201, fixes are also available from Red Hat [13].
An unauthenticated remote attacker can escape the Web Content sandbox using social engineering. Apple is aware of possible active exploitation of this vulnerability in specifically targeted, highly sophisticated attacks [1][2][12]. We have previously reported on the fix for this vulnerability in Apple operating systems [13].
The vulnerability is present in products:
- *:WebKitGTK;<2.48.0;
- *:WPE WebKit;<2.46.7;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-24201 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An unauthenticated remote attacker can carry out a DoS attack through malicious web content using social engineering [1][2][14].
The vulnerability is present in products:
- *:WebKitGTK;<2.48.0;
- *:WPE WebKit;<2.48.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
More information:
- CVE-2024-44192 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 10. 3. 2025.
Due to a flaw in cookie handling, an unauthenticated remote attacker can exfiltrate data across domains (cross-origin) using social engineering [1][2][15].
The vulnerability is present in products:
- *:WebKitGTK;<2.48.0;
- *:WPE WebKit;<2.48.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
More information:
- CVE-2024-54467 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 10. 3. 2025.
Links
- [1] https://webkitgtk.org/security/WSA-2025-0002.html
- [2] https://wpewebkit.org/security/WSA-2025-0002.html
- [3] https://www.cisa.gov/news-events/alerts/2025/03/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
- [4] https://support.apple.com/en-us/122283
- [5] https://support.apple.com/en-us/122281
- [6] https://support.apple.com/en-us/122285
- [7] https://support.apple.com/en-us/122284
- [8] https://support.apple.com/en-us/100100
- [9] https://security-tracker.debian.org/tracker/CVE-2025-24201
- [10] https://security-tracker.debian.org/tracker/CVE-2024-44192
- [11] https://security-tracker.debian.org/tracker/CVE-2024-54467
- [12] https://access.redhat.com/security/cve/cve-2025-24201
- [13] https://va2am.cesnet.cz/reports/405
- [14] https://nvd.nist.gov/vuln/detail/CVE-2024-44192
- [15] https://nvd.nist.gov/vuln/detail/CVE-2024-54467
By CESNET, z.s.p.o. Michaela Ručková on 24. 3. 2025.