Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2025-43212: Safari and Apple OSes may crash from malicious web page
CVE-2025-43212 · published 1 year ago
Summary
Apple Safari and the listed Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can stop working if they process specially crafted web content. This can cause an unexpected crash of the Safari browser, potentially disrupting user activity. Install the latest updates (Safari 18.6 and the corresponding OS versions) to protect against this issue.
What to do
- Update debian webkit2gtk to version 2.48.5-1~deb11u1.
- Update debian webkit2gtk to version 2.48.5-1~deb12u1.
- Update debian webkit2gtk to version 2.48.5-1~deb13u1.
- Update debian webkit2gtk to version 2.48.5-1.
- Update canonical webkit2gtk to version 2.48.5-0ubuntu0.22.04.1.
- Update canonical webkit2gtk to version 2.48.5-0ubuntu0.24.04.1.
- Update debian wpewebkit to version 2.48.5-1.
- Update apple safari to version 18.6 or later.
- Update apple ipados to version 18.6 or later.
- Update apple iphone_os to version 18.6 or later.
- Update apple macos to version 15.6 or later.
- Update apple tvos to version 18.6 or later.
- Update apple visionos to version 2.6 or later.
- Update apple watchos to version 11.6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apple | safari |
< 18.6 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | ipados |
< 18.6 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| – | apple | iphone_os |
< 18.6 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | macos |
< 15.6 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| – | apple | tvos |
< 18.6 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
| – | apple | visionos |
< 2.6 cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
| – | apple | watchos |
< 11.6 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
| Debian:11 | debian | webkit2gtk |
< 2.48.5-1~deb11u1 Fix: upgrade to 2.48.5-1~deb11u1
|
| Debian:12 | debian | webkit2gtk |
< 2.48.5-1~deb12u1 Fix: upgrade to 2.48.5-1~deb12u1
|
| Debian:13 | debian | webkit2gtk |
< 2.48.5-1~deb13u1 Fix: upgrade to 2.48.5-1~deb13u1
|
| Debian:14 | debian | webkit2gtk |
< 2.48.5-1 Fix: upgrade to 2.48.5-1
|
| Debian:11 | debian | wpewebkit | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:18.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:18.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:20.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:20.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:20.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:22.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:22.04:LTS | canonical | webkit2gtk |
< 2.48.5-0ubuntu0.22.04.1 Fix: upgrade to 2.48.5-0ubuntu0.22.04.1
|
| Ubuntu:22.04:LTS | canonical | wpewebkit | All versions |
| Ubuntu:24.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:24.04:LTS | canonical | webkit2gtk |
< 2.48.5-0ubuntu0.24.04.1 Fix: upgrade to 2.48.5-0ubuntu0.24.04.1
|
| Debian:12 | debian | wpewebkit | All versions |
| Debian:13 | debian | wpewebkit | All versions |
| Debian:14 | debian | wpewebkit |
< 2.48.5-1 Fix: upgrade to 2.48.5-1
|
Original advisory text
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciousl...
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References
- https://support.apple.com/en-us/124147 Release Notes Vendor Advisory
- http://seclists.org/fulldisclosure/2025/Aug/0
- https://security-tracker.debian.org/tracker/CVE-2025-43212 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-43212 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-43212 Third Party Advisory
- https://webkitgtk.org/security/WSA-2025-0005.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-7702-1 Vendor Advisory
- https://support.apple.com/en-us/124149 Release Notes Vendor Advisory
- https://support.apple.com/en-us/124152 Release Notes Vendor Advisory
- https://support.apple.com/en-us/124153 Release Notes Vendor Advisory
- https://support.apple.com/en-us/124154 Release Notes Vendor Advisory
- https://support.apple.com/en-us/124155 Release Notes Vendor Advisory
- http://seclists.org/fulldisclosure/2025/Jul/30
- http://seclists.org/fulldisclosure/2025/Jul/32
- http://seclists.org/fulldisclosure/2025/Jul/36
- http://www.openwall.com/lists/oss-security/2025/08/02/1
- https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-119Buffer Overflow
Timeline
Published30 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta