This advisory covers a set of nine security vulnerabilities in the WebKitGTK+ package for GTK+ 3 on Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issues include CVE-2025-6558 (angle: insufficient input validation causing undefined behavior), CVE-2025-43240 (incorrect download origin association), CVE-2025-31273 and CVE-2025-31278 (memory corruption from malicious web content), CVE-2025-43211 (denial-of-service), CVE-2025-43212 and CVE-2025-43216 (unexpected Safari crashes), and CVE-2025-43227 and CVE-2025-43265 (disclosure of sensitive user information and internal app states). These vulnerabilities arise from processing maliciously crafted web content or insufficient validation, potentially leading to memory corruption, crashes, denial-of-service, or information disclosure. Red Hat has issued patches as part of advisory RHSA-2025:15729 to address these issues.

The vulnerabilities can lead to undefined behavior, memory corruption, denial-of-service conditions, unexpected application crashes, and disclosure of sensitive user information or internal application states when processing maliciously crafted web content. These impacts can affect the stability and confidentiality of applications using WebKitGTK+ on affected Red Hat Enterprise Linux 7 systems.

Red Hat has released an official security update for webkitgtk4 in Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these vulnerabilities. Users should apply the update as described in Red Hat advisory RHSA-2025:15729 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official patch.