Description (CNA)
A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The WebKitGTK Team / webkitgtk | affected 0 before 2.50.3 |
| Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Support | unaffected 0:2.50.3-2.el7_9 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 0:2.50.3-1.el8_10 before * |
| Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 0:2.50.3-2.el8_2 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 0:2.50.3-2.el8_4 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | unaffected 0:2.50.3-2.el8_4 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 0:2.50.3-2.el8_6 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Service | unaffected 0:2.50.3-2.el8_6 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | unaffected 0:2.50.3-2.el8_6 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 0:2.50.3-2.el8_8 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | unaffected 0:2.50.3-2.el8_8 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:2.50.3-1.el9_7 before * |
| Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | unaffected 0:2.50.3-1.el9_0 before * |
| Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | unaffected 0:2.50.3-1.el9_2 before * |
| Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 0:2.50.3-1.el9_4 before * |
| Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 0:2.50.3-1.el9_6 before * |
| Red Hat / Red Hat Enterprise Linux 6 | unknown |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
CWE
CWE-346
References
- https://access.redhat.com/errata/RHSA-2025:22789
- https://access.redhat.com/errata/RHSA-2025:22790
- https://access.redhat.com/errata/RHSA-2025:23110
- https://access.redhat.com/errata/RHSA-2025:23433
- https://access.redhat.com/errata/RHSA-2025:23434
- https://access.redhat.com/errata/RHSA-2025:23451
- https://access.redhat.com/errata/RHSA-2025:23452
- https://access.redhat.com/errata/RHSA-2025:23583
- https://access.redhat.com/errata/RHSA-2025:23591
- https://access.redhat.com/errata/RHSA-2025:23742
- https://access.redhat.com/errata/RHSA-2025:23743
- https://access.redhat.com/security/cve/CVE-2025-13947
- https://bugs.webkit.org/show_bug.cgi?id=271957
- https://bugzilla.redhat.com/show_bug.cgi?id=2418576
ADP enrichment
No English description supplied.
No references supplied.