Back Linuxsecurity

Debian 11: Webkit2gtk Critical Security Update DLA-4394-1 CVE-2025

Linuxsecurity •LinuxSecurity Advisories • December 4, 2025

CVE-2025-43392 Tom Van Goethem discovered that a website may exfiltrate image data cross-origin. CVE-2025-43425 An anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43427 Gary Kwong and rheza discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43429 Google Big Sleep discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43430 Google Big Sleep discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43431 Google Big Sleep discovered that processing maliciously crafted web content may lead to memory corruption. CVE-2025-43432 Hossein Lotfi discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43434

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Debian WebKitGTK Vulnerabilities Lead to Image Data Exfiltration and Crashes Multiple vulnerabilities in WebKitGTK have been identified, affecting Debian 11 users. Key issues include CVE-2025-43392, which allows cross-origin image data exfiltration, and several crash vulnerabilities (CVE-2025-43425, CVE-2025-43427, CVE-2025-43429) caused by processing malicious web content. These vulnerabilities were discovered by various researchers, including Tom Van Goethem and Gary Kwong. 6 sources 53

Extracted Entities

CVEs (8)

CVE-2025-43392 CVE-2025-43425 CVE-2025-43427 CVE-2025-43429 CVE-2025-43430 CVE-2025-43431 CVE-2025-43432 CVE-2025-43434

Platforms (2)

Debian 11 Webkit2gtk