{"id":"CLSA-2026-1777544437","summary":"webkit2gtk3: Fix of 35 CVEs","details":"- Rebase to webkitgtk 2.52.3 to address WebKitGTK security advisories\n  WSA-2026-0001 and WSA-2026-0002 (matches RHSA-2026:9692).\n- Drop all CVE-2025-* backport patches (Patch100..Patch112); the fixes are\n  included in 2.52.3 upstream.\n- Drop fix-missing-typename.patch: target source file was removed upstream.\n- Adapt fix-compositemode-init.patch, fix-renderelement-binding.patch, and\n  fix-renderflexbox-typename.patch to 2.52.3 line offsets (same semantic\n  clang15 / libstdc++ compat fix).\n- Refresh all CentOS Stream 9-derived patches to the versions that ship\n  with c9s webkit2gtk3-2.52.3 (glib-2-68, libsoup2, icu-67,\n  g-ir-scanner-nonfatal, evolution-sandbox-warning, aarch64-build) and\n  reorder them to match c9s so they apply with rpm's --fuzz=0 --strict\n  mode. Our previously-carried versions targeted the 2.50.1 source tree\n  and broke when applied against 2.52.3.\n- Switch build toolchain from Clang 15 to gcc-toolset-12 (GCC 12).\n  AlmaLinux 9.2 ESU ships Clang 15 as its system compiler, but Clang 15\n  does not implement C++20 P0634R3 (\"implicit typename\") nor the\n  `requires`-clause name-lookup fix needed to compile WebKit 2.52+.\n  GCC 12 implements both and is fully supported upstream. %global\n  toolchain is now gcc; BuildRequires updated accordingly; gcc-toolset-12\n  is enabled in %build via /opt/rh/gcc-toolset-12/enable.\n- Drop tarball signature/hash verification from %prep. Upstream's 2.52.3\n  .asc was signed with an expired DSA key (key expired 2026-04-14, signature\n  made 2026-04-16), so gpgv 2.3.x refuses it. The tarball lives in Gerrit\n  under change control, so the per-build verify step is redundant. Source1\n  (.asc) and Source2 (keyring) are removed along with their files.\n- CVEs resolved by this rebase (30 total):\n  WSA-2026-0001 (fixed upstream in 2.50.5 / 2.50.6):\n    CVE-2025-43433, CVE-2025-43438, CVE-2025-43441, CVE-2025-43457,\n    CVE-2025-43511, CVE-2025-46299, CVE-2026-20608, CVE-2026-20635,\n    CVE-2026-20636, CVE-2026-20644, CVE-2026-20652, CVE-2026-20676\n  WSA-2026-0002 (fixed in 2.52.1):\n    CVE-2026-20643, CVE-2026-20664, CVE-2026-20665, CVE-2026-20691,\n    CVE-2026-28857, CVE-2026-28859, CVE-2026-28871\n  Older Apple waves superseded by this rebase (from WSA-2025-0008/0009/0010,\n  previously tracked by WIP Gerrit change 245288):\n    CVE-2025-13947, CVE-2025-14174, CVE-2025-43431, CVE-2025-43443,\n    CVE-2025-43458, CVE-2025-43501, CVE-2025-43529, CVE-2025-43531,\n    CVE-2025-43535, CVE-2025-43536, CVE-2025-43541\n  CVEs from these advisories that were already fixed in 2.50.1 (no action\n  needed): CVE-2023-43010 (2.44.0), CVE-2025-31223 / CVE-2025-31277 (2.50.0),\n  CVE-2025-43213 / CVE-2025-43214 (cherry-picked onto the webkitglib/2.50\n  branch before the 2.50.0 tag).","modified":"2026-05-27T11:32:54.222734909Z","published":"2026-04-30T10:20:42Z","upstream":["CVE-2023-43010","CVE-2025-13947","CVE-2025-14174","CVE-2025-31223","CVE-2025-31277","CVE-2025-43213","CVE-2025-43214","CVE-2025-43431","CVE-2025-43433","CVE-2025-43438","CVE-2025-43441","CVE-2025-43443","CVE-2025-43457","CVE-2025-43458","CVE-2025-43501","CVE-2025-43511","CVE-2025-43529","CVE-2025-43531","CVE-2025-43535","CVE-2025-43536","CVE-2025-43541","CVE-2025-46299","CVE-2026-20608","CVE-2026-20635","CVE-2026-20636","CVE-2026-20643","CVE-2026-20644","CVE-2026-20652","CVE-2026-20664","CVE-2026-20665","CVE-2026-20676","CVE-2026-20691","CVE-2026-28857","CVE-2026-28859","CVE-2026-28871"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777544437.html"}],"affected":[{"package":{"name":"webkit2gtk3","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.3-1.el9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777544437.json"}},{"package":{"name":"webkit2gtk3-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.3-1.el9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777544437.json"}},{"package":{"name":"webkit2gtk3-jsc","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.3-1.el9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777544437.json"}},{"package":{"name":"webkit2gtk3-jsc-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/webkit2gtk3-jsc-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.3-1.el9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1777544437.json"}}],"schema_version":"1.7.5"}