Upstream has issued an advisory on December 17: https://webkitgtk.org/security/WSA-2025-0010.html The issues are fixed upstream in 2.50.4: https://webkitgtk.org/2025/12/16/webkitgtk2.50.4-released.html
Source RPM: (none) => webkit2-2.50.3-1.mga10.src.rpm, webkit2-2.50.3-1.mga9.src.rpmCVE: (none) => CVE-2025-14174, CVE-2025-43501, CVE-2025-43529, CVE-2025-43531, CVE-2025-43535, CVE-2025-43536, CVE-2025-43541Whiteboard: (none) => MGA9TOO
Nicolas has just updated this in Cauldron, so remains M9 to do.
Whiteboard: MGA9TOO => (none)Assignee: bugsquad => pkg-bugsVersion: Cauldron => 9Status comment: (none) => fixed upstream in 2.50.4
Suggested advisory: ======================== The updated packages fix security vulnerabilities: CVE-2025-14174, CVE-2025-43501, CVE-2025-43529, CVE-2025-43531, CVE-2025-43535, CVE-2025-43536, CVE-2025-43541. References: https://webkitgtk.org/security/WSA-2025-0010.html https://webkitgtk.org/2025/12/16/webkitgtk2.50.4-released.html ======================== Updated packages in core/updates_testing: ======================== lib(64)javascriptcore-gir4.0-2.50.4-1.mga9 lib(64)javascriptcore-gir4.1-2.50.4-1.mga9 lib(64)javascriptcore-gir6.0-2.50.4-1.mga9 lib(64)javascriptcoregtk4.0_18-2.50.4-1.mga9 lib(64)javascriptcoregtk4.1_0-2.50.4-1.mga9 lib(64)javascriptcoregtk6.0_1-2.50.4-1.mga9 lib(64)webkit2gtk-gir4.0-2.50.4-1.mga9 lib(64)webkit2gtk-gir4.1-2.50.4-1.mga9 lib(64)webkit2gtk4.0-devel-2.50.4-1.mga9 lib(64)webkit2gtk4.0_37-2.50.4-1.mga9 lib(64)webkit2gtk4.1-devel-2.50.4-1.mga9 lib(64)webkit2gtk4.1_0-2.50.4-1.mga9 lib(64)webkitgtk-gir6.0-2.50.4-1.mga9 lib(64)webkitgtk6.0-devel-2.50.4-1.mga9 lib(64)webkitgtk6.0_4-2.50.4-1.mga9 webkit2-driver-2.50.4-1.mga9 webkit2gtk4.0-2.50.4-1.mga9 webkit2gtk4.0-jsc-2.50.4-1.mga9 webkit2gtk4.1-2.50.4-1.mga9 webkit2gtk4.1-jsc-2.50.4-1.mga9 webkitgtk6.0-2.50.4-1.mga9 webkitgtk6.0-jsc-2.50.4-1.mga9 from SRPM: webkit2-2.50.4-1.mga9.src.rpm
Source RPM: webkit2-2.50.3-1.mga10.src.rpm, webkit2-2.50.3-1.mga9.src.rpm => webkit2-2.50.3-1.mga9.src.rpmAssignee: pkg-bugs => qa-bugsStatus comment: fixed upstream in 2.50.4 => (none)Status: NEW => ASSIGNED
Removed CVEs for Apple's system & software
Keywords: (none) => advisoryCVE: CVE-2025-14174, CVE-2025-43501, CVE-2025-43529, CVE-2025-43531, CVE-2025-43535, CVE-2025-43536, CVE-2025-43541 => CVE-2025-43501, CVE-2025-43531, CVE-2025-43535, CVE-2025-43536
installing webkit2gtk4.1-2.50.4-1.mga9.x86_64.rpm lib64javascriptcore-gir4.1-2.50.4-1.mga9.x86_64.rpm lib64javascriptcoregtk4.1_0-2.50.4-1.mga9.x86_64.rpm lib64webkit2gtk4.1_0-2.50.4-1.mga9.x86_64.rpm webkit2-driver-2.50.4-1.mga9.x86_64.rpm lib64webkit2gtk-gir4.1-2.50.4-1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64 Preparing... ################################################################################################### 1/6: lib64javascriptcoregtk4.1_0 ################################################################################################### 2/6: lib64javascriptcore-gir4.1 ################################################################################################### 3/6: webkit2-driver ################################################################################################### 4/6: lib64webkit2gtk4.1_0 ################################################################################################### 5/6: webkit2gtk4.1 ################################################################################################### 6/6: lib64webkit2gtk-gir4.1 ################################################################################################### 1/6: removing lib64webkit2gtk-gir4.1-2.50.3-1.mga9.x86_64 ################################################################################################### 2/6: removing webkit2gtk4.1-2.50.3-1.mga9.x86_64 ################################################################################################### 3/6: removing lib64javascriptcore-gir4.1-2.50.3-1.mga9.x86_64 ################################################################################################### 4/6: removing lib64webkit2gtk4.1_0-2.50.3-1.mga9.x86_64 ################################################################################################### 5/6: removing lib64javascriptcoregtk4.1_0-2.50.3-1.mga9.x86_64 ################################################################################################### 6/6: removing webkit2-driver-2.50.3-1.mga9.x86_64 ################################################################################################### mcc works poedit works gnome-boxes-works install evolution, the application start but as I not user of the application I can't confirm if bug#34855 is still here Install epiphany, browse some mageia's sites Looks good here
MGA9-64 server Plasma Wayland on Compaq H000SB. No installation issues. Ref bug 34792. Jumped around in MCC as test,opened a pdf with atril and used: $ zenity --calendar 22/12/25 In view of other tes above, OK.
Whiteboard: (none) => MGA9-64-OKCC: (none) => herman.viaene
MGA9-32 Xfce on a HP Probook 6550b, i3 M350, Intel graphics. This install on this laptop has seen issues with MCC and webkit2. See bug 33208. 64-bit installs are OK. I'm seeing this in drakrpm-update: The following packages have to be removed for others to be upgraded: libboost_python310_1.81.0-1.81.0-3.1.mga9.i586 (due to missing libpython3.10.so.1.0) libpython3.10-3.10.18-1.4.mga9.i586 (due to unsatisfied libpython3.10-stdlib == 3.10.18-1.4.mga9) libpython3.10-stdlib-3.10.18-1.4.mga9.i586 (due to unsatisfied python(abi) == 3.10, due to missing libpython3.10.so.1.0) Nobody is mentioning them in the 64-bit tests. Is this an issue, or should I go ahead with the 32-bit test?
CC: (none) => andrewsfarm
My guess is that those packages got installed as dependencies for some other package. Which one , your guess would be as good as mine, since I suspect that "how many?" are dependent on python libs. I would proceed, but if your conscience keeps nagging you, try urpmq --whatrequires.
(In reply to Thomas Andrews from comment #6) > MGA9-32 Xfce on a HP Probook 6550b, i3 M350, Intel graphics. This install on > this laptop has seen issues with MCC and webkit2. See bug 33208. 64-bit > installs are OK. > > I'm seeing this in drakrpm-update: > > The following packages have to be removed for others to be upgraded: > libboost_python310_1.81.0-1.81.0-3.1.mga9.i586 > (due to missing libpython3.10.so.1.0) > libpython3.10-3.10.18-1.4.mga9.i586 > (due to unsatisfied libpython3.10-stdlib == 3.10.18-1.4.mga9) > libpython3.10-stdlib-3.10.18-1.4.mga9.i586 > (due to unsatisfied python(abi) == 3.10, > due to missing libpython3.10.so.1.0) > > Nobody is mentioning them in the 64-bit tests. Is this an issue, or should I > go ahead with the 32-bit test? The interesting is the packages are i586 Did you have all the necessary 32b repositories enabled?
Uh-oh. Now I see what has happened. I must have tried upgrading this install to Cauldron using urpmi a while back, so long ago that I forgot about it. It must have failed part way through, leaving me with a hybrid system, partly MGA9, partly MGA10, identifying itself as MGA9. I'm surprised it works as well as it does. Sorry about the noise.
(In reply to katnatek from comment #8) > (In reply to Thomas Andrews from comment #6) > > MGA9-32 Xfce on a HP Probook 6550b, i3 M350, Intel graphics. This install on > > this laptop has seen issues with MCC and webkit2. See bug 33208. 64-bit > > installs are OK. > > > > I'm seeing this in drakrpm-update: > > > > The following packages have to be removed for others to be upgraded: > > libboost_python310_1.81.0-1.81.0-3.1.mga9.i586 > > (due to missing libpython3.10.so.1.0) > > libpython3.10-3.10.18-1.4.mga9.i586 > > (due to unsatisfied libpython3.10-stdlib == 3.10.18-1.4.mga9) > > libpython3.10-stdlib-3.10.18-1.4.mga9.i586 > > (due to unsatisfied python(abi) == 3.10, > > due to missing libpython3.10.so.1.0) > > > > Nobody is mentioning them in the 64-bit tests. Is this an issue, or should I > > go ahead with the 32-bit test? > > The interesting is the packages are i586 > Did you have all the necessary 32b repositories enabled? It's 64-bit hardware, but a 32-bit install. 32-bit repos are the only ones that are enabled. Going to try finishing the upgrade, using drakrpm-edit-media --expert to enable the core repos for update, and see what happens. Probably would be easier and more reliable to do a clean install from the live media, but I'm curious...
1677 packages left to go...
Nope. Failed, miserably. On to other things.
MGA9-32 Xfce on Foolishness, my Dell Inspiron 5100, P4, Radeon RV200 graphics No installation issues. Checked with urpmq, ran MCC (no issues), and installed two Gnome games, four-in-a-row and five-or-more. Played a game of each with no issues, except that I lost to the computer. Looks good on 32-bit real hardware. Validating.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugsWhiteboard: MGA9-64-OK => MGA9-64-OK MGA9-32-OK
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2025-0331.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED