ALAS2-2026-3917

Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3917
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
Severity: Important
Issue Overview:

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2026-64715)

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-64779)

The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-64780)

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-64784)

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65331)

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65333)

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65334)

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65335)

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65336)

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65337)

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65338)

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65340)

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption. (CVE-2026-65341)

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. (CVE-2026-78376)

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. (CVE-2026-83596)


Affected Packages:

webkitgtk4


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update webkitgtk4 or yum update --advisory ALAS2-2026-3917 to update your system.

New Packages:
aarch64:
    webkitgtk4-2.52.6-1.amzn2.0.2.aarch64
    webkitgtk4-devel-2.52.6-1.amzn2.0.2.aarch64
    webkitgtk4-jsc-2.52.6-1.amzn2.0.2.aarch64
    webkitgtk4-jsc-devel-2.52.6-1.amzn2.0.2.aarch64

i686:
    webkitgtk4-2.52.6-1.amzn2.0.2.i686
    webkitgtk4-devel-2.52.6-1.amzn2.0.2.i686
    webkitgtk4-jsc-2.52.6-1.amzn2.0.2.i686
    webkitgtk4-jsc-devel-2.52.6-1.amzn2.0.2.i686

src:
    webkitgtk4-2.52.6-1.amzn2.0.2.src

x86_64:
    webkitgtk4-2.52.6-1.amzn2.0.2.x86_64
    webkitgtk4-devel-2.52.6-1.amzn2.0.2.x86_64
    webkitgtk4-jsc-2.52.6-1.amzn2.0.2.x86_64
    webkitgtk4-jsc-devel-2.52.6-1.amzn2.0.2.x86_64

Additional References

Red Hat: CVE-2026-64715, CVE-2026-64779, CVE-2026-64780, CVE-2026-64784, CVE-2026-65331, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338, CVE-2026-65340, CVE-2026-65341, CVE-2026-78376, CVE-2026-83596

Mitre: CVE-2026-64715, CVE-2026-64779, CVE-2026-64780, CVE-2026-64784, CVE-2026-65331, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338, CVE-2026-65340, CVE-2026-65341, CVE-2026-78376, CVE-2026-83596