CVE-2025-31205

NameCVE-2025-31205
DescriptionThe issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4218-1, DSA-5937-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
webkit2gtk (PTS)bullseye2.44.2-1~deb11u1vulnerable
bullseye (security)2.48.3-1~deb11u1fixed
bookworm2.48.1-2~deb12u1vulnerable
bookworm (security)2.48.3-1~deb12u1fixed
sid, trixie2.48.3-1fixed
wpewebkit (PTS)bullseye (security), bullseye2.38.6-1~deb11u1vulnerable
bookworm2.38.6-1vulnerable
sid, trixie2.48.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
webkit2gtksourcebullseye2.48.3-1~deb11u1DLA-4218-1
webkit2gtksourcebookworm2.48.3-1~deb12u1DSA-5937-1
webkit2gtksource(unstable)2.48.2-1
wpewebkitsource(unstable)2.48.2-1

Notes

[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
[bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported)
https://webkitgtk.org/security/WSA-2025-0004.html
https://project-zero.issues.chromium.org/issues/408172161

Search for package or bug name: Reporting problems