No registered maintainer, so assigning to all.
CC'ing daviddavid, who was the last one to touch this package

Assignee: bugsquad => pkg-bugs
CC: (none) => geiger.david68210, marja11

Upstream has released 2.44.4:
https://webkitgtk.org/release/webkitgtk-2.44.4.html

Upstream has released 2.46.0:
https://webkitgtk.org/2024/09/17/webkitgtk2.46.0-released.html

Upping priority because dependency of already shipped icu Bug 33553

CC: (none) => fri
Priority: Normal => High

Upstream has issued an advisory on September 25:
https://webkitgtk.org/security/WSA-2024-0005.html

CVE: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780, CVE-2024-40782, CVE-2024-40789, CVE-2024-4558 => CVE-2024-40776, CVE-2024-40779, CVE-2024-40780, CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-23271, CVE-2024-27808, CVE-2024-27820, CVE-2024-27833, CVE-2024-27838, CVE-2024-27851, CVE-2024-40866, CVE-2024-44187
Summary: webkit2 security issue fixed upstream (WSA-2024-0004) => webkit2 security issues fixed upstream (WSA-2024-0004, WSA-2024-0005)

Upstream has released 2.46.1:
https://webkitgtk.org/2024/09/30/webkitgtk2.46.1-released.html

Upstream has released 2.46.2:
https://webkitgtk.org/2024/10/21/webkitgtk2.46.2-released.html

Upstream has released 2.46.3:
https://webkitgtk.org/2024/10/30/webkitgtk2.46.3-released.html

Upstream has issued an advisory on October 31:
https://webkitgtk.org/security/WSA-2024-0006.html

CVE: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780, CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-23271, CVE-2024-27808, CVE-2024-27820, CVE-2024-27833, CVE-2024-27838, CVE-2024-27851, CVE-2024-40866, CVE-2024-44187 => CVE-2024-40776, CVE-2024-40779, CVE-2024-40780, CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-23271, CVE-2024-27808, CVE-2024-27820, CVE-2024-27833, CVE-2024-27838, CVE-2024-27851, CVE-2024-40866, CVE-2024-44187, CVE-2024-44185, CVE-2024-44244, CVE-2024-44296
Summary: webkit2 security issues fixed upstream (WSA-2024-0004, WSA-2024-0005) => webkit2 security issues fixed upstream (WSA-2024-0004, WSA-2024-0005, WSA-2024-0006)

Upstream has released 2.46.4:
https://webkitgtk.org/2024/11/27/webkitgtk2.46.4-released.html

Upstream has issued an advisory on November 27:
https://webkitgtk.org/security/WSA-2024-0007.html

Summary: webkit2 security issues fixed upstream (WSA-2024-0004, WSA-2024-0005, WSA-2024-0006) => webkit2 security issues fixed upstream (WSA-2024-000[4-7])

This need to be progressed...

Severity: normal => major

Upstream has released 2.46.5:
https://webkitgtk.org/2024/12/18/webkitgtk2.46.5-released.html


Upstream has issued an advisory on December 22:
https://webkitgtk.org/security/WSA-2024-0008.html

Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-7]) => webkit2 security issues fixed upstream (WSA-2024-000[4-8])

Upstream has released 2.46.6:
https://webkitgtk.org/2025/02/07/webkitgtk2.46.6-released.html

Upstream has issued an advisory on February 9:
https://webkitgtk.org/security/WSA-2025-0001.html

Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-8]) => webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-0001)
Source RPM: webkit2-2.44.2-2.mga10.src.rpm => webkit2-2.46.5-1.mga10.src.rpm, webkit2-2.44.2-1.mga9.src.rpm

Upstream has released 2.48.0:
https://webkitgtk.org/2025/03/14/webkitgtk2.48.0-released.html

Upstream has issued an advisory on March 20:
https://webkitgtk.org/security/WSA-2025-0002.html

Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-0001) => webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[12])

Upstream has released 2.48.1:
https://webkitgtk.org/2025/04/02/webkitgtk2.48.1-released.html

Upstream has issued an advisory on April 7:
https://webkitgtk.org/security/WSA-2025-0003.html

Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[12]) => webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-3])

Upstream has released 2.48.2:
https://webkitgtk.org/2025/05/14/webkitgtk2.48.2-released.html

Upstream has issued an advisory on May 15:
https://webkitgtk.org/security/WSA-2025-0004.html

Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-3]) => webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-4])

Upstream has released 2.48.3:
https://webkitgtk.org/2025/05/28/webkitgtk2.48.3-released.html

For Cauldron, webkit2-2.48.3-1.mga10 solves those issues.

Whiteboard: MGA9TOO => (none)
Source RPM: webkit2-2.46.5-1.mga10.src.rpm, webkit2-2.44.2-1.mga9.src.rpm => webkit2-2.44.2-1.mga9.src.rpm
Version: Cauldron => 9

Upstream has released 2.48.4:
https://webkitgtk.org/2025/07/31/webkitgtk2.49.4-released.html

Upstream has released 2.48.5:
https://webkitgtk.org/2025/08/01/webkitgtk2.48.5-released.html

Upstream has issued an advisory on August 1:
https://webkitgtk.org/security/WSA-2025-0005.html

Whiteboard: (none) => MGA9TOO
Version: 9 => Cauldron
Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-4]) => webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-5])

Upstream has released 2.48.6:
https://webkitgtk.org/2025/09/03/webkitgtk2.48.6-released.html

Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)

Upstream has released 2.50.0:
https://webkitgtk.org/2025/09/17/webkitgtk2.50.0-released.html

Upstream has issued an advisory on September 23:
https://webkitgtk.org/security/WSA-2025-0006.html

Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-5]) => webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-6])

Upstream has released 2.50.1:
https://webkitgtk.org/2025/10/10/webkitgtk2.50.1-released.html

Upstream has issued an advisory on October 13:
https://webkitgtk.org/security/WSA-2025-0007.html

Summary: webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-6]) => webkit2 security issues fixed upstream (WSA-2024-000[4-8] and WSA-2025-000[1-7])

For Cauldron, webkit2-2.50.1-1.mga10 solves those issues.

Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)

I will just make a rebuild for the icu73 bugs, removing the block

Blocks: 34687 => (none)

Restoring the block, the version 2.44.4 is building now

Blocks: (none) => 34687

SRPM: webkit2-2.44.4-1.mga9

RPMS:
lib(64)javascriptcore-gir4.0-2.44.4-1.mga9
lib(64)javascriptcore-gir4.1-2.44.4-1.mga9
lib(64)javascriptcore-gir6.0-2.44.4-1.mga9
lib(64)javascriptcoregtk4.0_18-2.44.4-1.mga9
lib(64)javascriptcoregtk4.1_0-2.44.4-1.mga9
lib(64)javascriptcoregtk6.0_1-2.44.4-1.mga9
lib(64)webkit2gtk-gir4.0-2.44.4-1.mga9
lib(64)webkit2gtk-gir4.1-2.44.4-1.mga9
lib(64)webkit2gtk4.0-devel-2.44.4-1.mga9
lib(64)webkit2gtk4.0_37-2.44.4-1.mga9
lib(64)webkit2gtk4.1-devel-2.44.4-1.mga9
lib(64)webkit2gtk4.1_0-2.44.4-1.mga9
lib(64)webkitgtk-gir6.0-2.44.4-1.mga9
lib(64)webkitgtk6.0-devel-2.44.4-1.mga9
lib(64)webkitgtk6.0_4-2.44.4-1.mga9
webkit2-driver-2.44.4-1.mga9
webkit2-driver-debuginfo-2.44.4-1.mga9
webkit2gtk4.0-2.44.4-1.mga9
webkit2gtk4.0-jsc-2.44.4-1.mga9
webkit2gtk4.1-2.44.4-1.mga9
webkit2gtk4.1-jsc-2.44.4-1.mga9
webkitgtk6.0-2.44.4-1.mga9
webkitgtk6.0-jsc-2.44.4-1.mga9

If it is possible I will like some information about why this is the version used as it not fix all the CVEs, thank you

Assignee: pkg-bugs => qa-bugs
CC: (none) => pkg-bugs

installing lib64javascriptcoregtk4.1_0-2.44.4-1.mga9.x86_64.rpm lib64javascriptcore-gir4.1-2.44.4-1.mga9.x86_64.rpm lib64webkit2gtk-gir4.1-2.44.4-1.mga9.x86_64.rpm lib64webkit2gtk4.1_0-2.44.4-1.mga9.x86_64.rpm webkit2-driver-2.44.4-1.mga9.x86_64.rpm webkit2gtk4.1-2.44.4-1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ####################################################################################################
      1/6: lib64javascriptcoregtk4.1_0
                                 ####################################################################################################
      2/6: lib64javascriptcore-gir4.1
                                 ####################################################################################################
      3/6: webkit2-driver        ####################################################################################################
      4/6: lib64webkit2gtk4.1_0  ####################################################################################################
      5/6: webkit2gtk4.1         ####################################################################################################
      6/6: lib64webkit2gtk-gir4.1
                                 ####################################################################################################
      1/6: removing lib64webkit2gtk-gir4.1-2.44.2-1.mga9.x86_64
                                 ####################################################################################################
      2/6: removing lib64javascriptcore-gir4.1-2.44.2-1.mga9.x86_64
                                 ####################################################################################################
      3/6: removing lib64webkit2gtk4.1_0-2.44.2-1.mga9.x86_64
                                 ####################################################################################################
      4/6: removing webkit2gtk4.1-2.44.2-1.mga9.x86_64
                                 ####################################################################################################
      5/6: removing lib64javascriptcoregtk4.1_0-2.44.2-1.mga9.x86_64
                                 ####################################################################################################
      6/6: removing webkit2-driver-2.44.2-1.mga9.x86_64
                                 ####################################################################################################

mcc OK
strace gnome-boxes shows
openat(AT_FDCWD, "/usr/lib64/libwebkit2gtk-4.1.so.0", O_RDONLY|O_CLOEXEC) = 3

Good for the moment

installing libwebkit2gtk-gir4.0-2.44.4-1.mga9.i586.rpm libjavascriptcoregtk4.1_0-2.44.4-1.mga9.i586.rpm webkit2gtk4.1-2.44.4-1.mga9.i586.rpm libwebkit2gtk4.1_0-2.44.4-1.mga9.i586.rpm libwebkit2gtk4.0_37-2.44.4-1.mga9.i586.rpm libjavascriptcore-gir4.0-2.44.4-1.mga9.i586.rpm libwebkit2gtk-gir4.1-2.44.4-1.mga9.i586.rpm webkit2-driver-2.44.4-1.mga9.i586.rpm libjavascriptcore-gir4.1-2.44.4-1.mga9.i586.rpm webkit2gtk4.0-2.44.4-1.mga9.i586.rpm libjavascriptcoregtk4.0_18-2.44.4-1.mga9.i586.rpm from //home/katnatek/qa-testing/i586
Preparing...                     #######################################################################################
     1/11: libjavascriptcoregtk4.1_0
                                 #######################################################################################
     2/11: libjavascriptcoregtk4.0_18
                                 #######################################################################################
     3/11: webkit2-driver        #######################################################################################
     4/11: libjavascriptcore-gir4.0
                                 #######################################################################################
     5/11: libjavascriptcore-gir4.1
                                 #######################################################################################
     6/11: webkit2gtk4.1         #######################################################################################
     7/11: libwebkit2gtk4.1_0    #######################################################################################
     8/11: webkit2gtk4.0         #######################################################################################
     9/11: libwebkit2gtk4.0_37   #######################################################################################
    10/11: libwebkit2gtk-gir4.0  #######################################################################################
    11/11: libwebkit2gtk-gir4.1  #######################################################################################
     1/11: removing libwebkit2gtk-gir4.1-2.44.2-1.mga9.i586
                                 #######################################################################################
     2/11: removing libwebkit2gtk-gir4.0-2.44.2-1.mga9.i586
                                 #######################################################################################
     3/11: removing webkit2gtk4.1-2.44.2-1.mga9.i586
                                 #######################################################################################
     4/11: removing libwebkit2gtk4.0_37-2.44.2-1.mga9.i586
                                 #######################################################################################
     5/11: removing webkit2gtk4.0-2.44.2-1.mga9.i586
                                 #######################################################################################
     6/11: removing libjavascriptcore-gir4.0-2.44.2-1.mga9.i586
                                 #######################################################################################
     7/11: removing libjavascriptcore-gir4.1-2.44.2-1.mga9.i586
                                 #######################################################################################
     8/11: removing libwebkit2gtk4.1_0-2.44.2-1.mga9.i586
                                 #######################################################################################
     9/11: removing libjavascriptcoregtk4.1_0-2.44.2-1.mga9.i586
                                 #######################################################################################
    10/11: removing libjavascriptcoregtk4.0_18-2.44.2-1.mga9.i586
                                 #######################################################################################
    11/11: removing webkit2-driver-2.44.2-1.mga9.i586
                                 #######################################################################################

mcc works

Hi,

As I said before in the dev ml, update webkit2 to that version is totally useless.  All Web browsers packaged in Mageia 9 and that use webkit2 as their Web engine (Gnome Web aka epiphany, midori...) are not safe at all.  It is like saying to the users of those browsers : "There is no danger using a more than a year-old browser which is affected by dozens of security issues."

Best regards,

(In reply to Nicolas Salguero from comment #30)
> Hi,
> 
> As I said before in the dev ml, update webkit2 to that version is totally
> useless.  All Web browsers packaged in Mageia 9 and that use webkit2 as
> their Web engine (Gnome Web aka epiphany, midori...) are not safe at all. 
> It is like saying to the users of those browsers : "There is no danger using
> a more than a year-old browser which is affected by dozens of security
> issues."
> 
> Best regards,

I will make a test build of 2.50.1, will see what happen

(In reply to Nicolas Salguero from comment #30)
> Hi,
> 
> As I said before in the dev ml, update webkit2 to that version is totally
> useless.  All Web browsers packaged in Mageia 9 and that use webkit2 as
> their Web engine (Gnome Web aka epiphany, midori...) are not safe at all. 
> It is like saying to the users of those browsers : "There is no danger using
> a more than a year-old browser which is affected by dozens of security
> issues."
> 
> Best regards,

2.50.1 with gcc dies in i586 due memory exhausting and fail in all architectures with clang, use 2.44.4 could be bad but is worst keep using current version, perhaps both fails are related to try to keep building without sse2

Mga9-64 Plasma, i5-7500, Nvidia Quadro K620 graphics, using the nvidia-current driver. 

No installation issues using the list in comment 27, except that webkit2-driver-debuginfo-2.44.4-1.mga9 is not in the testing repos. 

Ran MCC, the usual test lately, and it seems to be working as it should. Urpmq reveals that one of the libraries is required by Gnome-Boxes, so I ran that and opened a Mageia 9 Plasma VM That hadn't been used in many months. I had the guest get all of the 290 pending updates, then rebooted as instructed. Closing the VM, I opened dialogs for "about" and the VM settings, all with no errors.

An attempt to run zenity, a test used previously for webkit2, showed it wasn't installed. After using MCC to install it, "zenity --calendar" ran as it had in previous tests.

Atril, another app used to test these packages, was also not installed here. Once again I called on MCC for installation, after which I ran it without issues.

Looks OK here.

CC: (none) => andrewsfarm

(In reply to Thomas Andrews from comment #33)
> Mga9-64 Plasma, i5-7500, Nvidia Quadro K620 graphics, using the
> nvidia-current driver. 
> 
> No installation issues using the list in comment 27, except that
> webkit2-driver-debuginfo-2.44.4-1.mga9 is not in the testing repos. 
That was obviously a mistake ;)

So where are we going with this? 2.44.2-1, such as it is, has passed enough tests to validate and send on, but...

Nicolas S. says this version is too old and insecure, and katnatek says it's better than nothing and newer packages won't build for i586.

Are we shipping this one now because it's better than nothing, or are we holding it to try to fix the issues in comment 32?

(In reply to Thomas Andrews from comment #35)
> So where are we going with this? 2.44.2-1, such as it is, has passed enough
> tests to validate and send on, but...
> 
> Nicolas S. says this version is too old and insecure, and katnatek says it's
> better than nothing and newer packages won't build for i586.
> 
> Are we shipping this one now because it's better than nothing, or are we
> holding it to try to fix the issues in comment 32?

I will make one or two more attempts but if I'm right and for 32b need to build with sse2 then the decision is out of my hands

Perhaps could check if other version 2.4x.y > 2.44.4 still build without issues as alternative

2.50.1 fail in i586 even with sse2, the only thing that remain to test is use llvm-suite packages to build (fail to build with clag 15)

I suggest validate 2.44.4 packages and open a bug for the remain security issues

Sounds like the best we are going to do, for now. And with the history of webkit2 and security troubles, no doubt more will show up before long.

Validating. 

Katnatek, will you take care of opening the new bug?

Whiteboard: (none) => MGA9-64-OK MGA9-32-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

I agree with this - lets get updates that we have out.

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0291.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED