The WebKitGTK Project

WebKitGTK 2.42.5 released!

2024-02-05T00:00:00+00:00

This is a bug fix release in the stable 2.42 series.

What’s new in the WebKitGTK 2.42.5 release?

Fix webkit_web_context_allow_tls_certificate_for_host to handle IPv6 URIs produced by SoupURI.
Ignore stops with offset zero before last one when rendering gradients with cairo.
Write bwrapinfo.json to disk for xdg-desktop-portal.
Fix gamepads detection by correctly handling focused window in GTK4.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001

2024-02-05T00:00:00+00:00

Date Reported: February 05, 2024
Advisory ID: WSA-2024-0001
CVE identifiers: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213, CVE-2023-40414, CVE-2023-42833, CVE-2014-1745.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2024-23222
- Versions affected: WebKitGTK and WPE WebKit before 2.42.5.
- Credit to Apple.
- Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited. Description: A type confusion issue was addressed with improved checks.
- WebKit Bugzilla: 267134
CVE-2024-23206
- Versions affected: WebKitGTK and WPE WebKit before 2.42.5.
- Credit to An anonymous researcher.
- Impact: A maliciously crafted webpage may be able to fingerprint the user. Description: An access issue was addressed with improved access restrictions.
- WebKit Bugzilla: 262699
CVE-2024-23213
- Versions affected: WebKitGTK and WPE WebKit before 2.42.5.
- Credit to Wangtaiyu of Zhongfu info.
- Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 266619
CVE-2023-40414
- Versions affected: WebKitGTK and WPE WebKit before 2.42.1.
- Credit to Francisco Alonso (@revskills).
- Impact: Processing web content may lead to arbitrary code execution. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 258992
CVE-2023-42833
- Versions affected: WebKitGTK and WPE WebKit before 2.38.0.
- Credit to Dong Jun Kim (@smlijun) and Jong Seong Kim (@nevul37) of AbyssLab.
- Impact: Processing web content may lead to arbitrary code execution. Description: A correctness issue was addressed with improved checks.
- WebKit Bugzilla: 258592
CVE-2014-1745
- Versions affected: WebKitGTK and WPE WebKit before 2.42.0.
- Credit to An anonymous researcher.
- Impact: Processing a file may lead to a denial-of-service or potentially disclose memory contents. Description: The issue was addressed with improved checks.
- WebKit Bugzilla: 249434

We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.

Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/.

WebKitGTK 2.43.4 released!

2024-02-02T00:00:00+00:00

This is a development release leading toward 2.44 series.

What’s new in the WebKitGTK 2.43.4 release?

Remove key event reinjection in GTK4 to make keyboard shortcuts work in web sites.
Use the new GTK API to create a GdkTexture from a DMA-BUF buffer when available.
Fix rendering when GTK is using the vulkan renderer.
Fix gamepads detection by correctly handling focused window in GTK4.
Fix rendering after history navigation.
Write bwrapinfo.json to disk for xdg-desktop-portal.
Fixed several memory leaks in media backend.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.43.3 released!

2023-12-21T00:00:00+00:00

This is a development release leading toward 2.44 series.

What’s new in the WebKitGTK 2.43.3 release?

Show vblank monitor information in webkit://gpu.
Fallback to timer based vblank monitor if drmWaitVBlank fails.
Fix several memory leaks in media backend.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0012

2023-12-18T00:00:00+00:00

Date Reported: December 18, 2023
Advisory ID: WSA-2023-0012
CVE identifiers: CVE-2023-42883, CVE-2023-42890.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2023-42883
- Versions affected: WebKitGTK and WPE WebKit before 2.42.4.
- Credit to Zoom Offensive Security Team.
- Impact: Processing a SVG image may lead to a denial-of-service. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 263349
CVE-2023-42890
- Versions affected: WebKitGTK and WPE WebKit before 2.42.0.
- Credit to Pwn2car.
- Impact: Processing web content may lead to arbitrary code execution. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 259830

Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/.

WebKitGTK 2.42.4 released!

2023-12-15T00:00:00+00:00

This is a bug fix release in the stable 2.42 series.

What’s new in the WebKitGTK 2.42.4 release?

Fix incorrect random images incorrectly displayed as backgrounds of <div> elements.
Fix videos displayed aliased after being resized e.g. in YouTube.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.42.3 released!

2023-12-05T00:00:00+00:00

This is a bug fix release in the stable 2.42 series.

What’s new in the WebKitGTK 2.42.3 release?

Fix flickering while playing videos with DMA-BUF sink.
Fix color picker being triggered in the inspector when typing “tan”.
Do not special case the “sans” font family name.
Fix build failure with libxml2 version 2.12.0 due to an API change.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0011

2023-12-05T00:00:00+00:00

Date Reported: December 05, 2023
Advisory ID: WSA-2023-0011
CVE identifiers: CVE-2023-42916, CVE-2023-42917.

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2023-42916
- Versions affected: WebKitGTK and WPE WebKit before 2.42.3.
- Credit to Clément Lecigne of Google’s Threat Analysis Group.
- Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited. Description: An out-of-bounds read was addressed with improved input validation.
- WebKit Bugzilla: 265041
CVE-2023-42917
- Versions affected: WebKitGTK and WPE WebKit before 2.42.3.
- Credit to Clément Lecigne of Google’s Threat Analysis Group.
- Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Description: A memory corruption vulnerability was addressed with improved locking.
- WebKit Bugzilla: 265067

Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/.

WebKitGTK 2.43.2 released!

2023-12-04T00:00:00+00:00

This is a development release leading toward 2.44 series.

What’s new in the WebKitGTK 2.43.2 release?

Remove the X11 and WPE renderers.
Release unused buffers when the view is hidden.
Fix flickering while playing videos with DMA-BUF sink.
Do not special case the “sans” font family name.
Fix webkit_web_context_allow_tls_certificate_for_host() for IPv6 URIs produced by SoupURI.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.43.1 released!

2023-11-17T00:00:00+00:00

This is the first development release leading toward 2.44 series.

What’s new in the WebKitGTK 2.43.1 release?

Improve vblank synchronization when rendering.
Improve DMA-BUF buffers handling for video frames.
Use the buffer format preferred by the driver in DMA-BUF renderer.
Do not block the compositing thread waiting for rendering threads.
Improve performance when scaling images in a canvas.
Fix several crashes and rendering issues.
Translation updates: Swedish.

Thanks to all the contributors who made possible this release.