此更新可解決下列弱點：

- CVE-2015-1120

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1120)

- CVE-2015-1076

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1076)

- CVE-2015-1071

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1071)

- CVE-2015-1081

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1081)

- CVE-2015-1122

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1122)

- CVE-2015-1155

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1155)

- CVE-2014-1748

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1748)

- CVE-2015-3752

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3752)

- CVE-2015-5809

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5809)

- CVE-2015-5928

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5928)

- CVE-2015-3749

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3749)

- CVE-2015-3659

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3659)

- CVE-2015-3748

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3748)

- CVE-2015-3743

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3743)

- CVE-2015-3731

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3731)

- CVE-2015-3745

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3745)

- CVE-2015-5822

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5822)

- CVE-2015-3658

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3658)

- CVE-2015-3741

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3741)

- CVE-2015-3727

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3727)

- CVE-2015-5801

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5801)

- CVE-2015-5788

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5788)

- CVE-2015-3747

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3747)

- CVE-2015-5794

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5794)

- CVE-2015-1127

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1127)

- CVE-2015-1153

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1153)

- CVE-2015-1083

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1083)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

此 webkitgtk 更新可修正下列問題：

- webkitgtk 已更新至 2.4.10 版 (boo#971460)：

+ 修正 GTK+ >= 3.19 的表單控制項和捲軸轉譯方式。

+ 修正 PPC64 的損毀。

+ 修正 powerpc 32 位元的版本。

+ 新增 ARM64 版本支援。

+ 安全性修正：CVE-2015-1120、CVE-2015-1076、CVE-2015-1071、CVE-2015-1081、CVE-2015-1122、CVE-2015-1155、CVE-2014-1748、CVE-2015-3752、CVE-2015-5809、CVE-2015-5928、CVE-2015-3749、CVE-2015-3659、CVE-2015-3748、CVE-2015-3743、CVE-2015-3731、CVE-2015-3745、CVE-2015-5822、CVE-2015-3658、CVE-2015-3741、CVE-2015-3727、CVE-2015-5801、CVE-2015-5788、CVE-2015-3747、CVE-2015-5794、CVE-2015-1127、CVE-2015-1153、CVE-2015-1083。

+ 已更新轉譯。

行動裝置執行的 iOS 版本比 8.4.1 舊。
因此受到下列元件中的弱點影響：

  - Air Traffic
  - AppleFileConduit
  - 備份
  - bootp
  - CFPreferences
  - Certificate UI
  - CloudKit
  - 程式碼簽署
  - CoreMedia Playback
  - CoreText
  - DiskImages
  - FontParser
  - IOHIDFamily
  - IOKit
  - ImageIO
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - Location Framework
  - MSVDX 驅動程式
  - MobileInstallation
  - Office Viewer
  - QL Office
  - Safari
  - Sandbox_profiles
  - UIKit View
  - Web
  - WebKit

遠端 Mac OS X 主機上安裝的 Apple Safari 版本比 6.2.8 / 7.1.8 / 8.0.8 舊。因此，該應用程式受到以下弱點影響：

  - 存在一個不明瑕疵，會讓攻擊者得以利用特製網頁來偽造 UI 元素。
    (CVE-2015-3729)

  - WebKit 中存有多個記憶體損毀瑕疵，這是因為不當驗證使用者提供的輸入所致。攻擊者可惡意利用這些瑕疵，使用特製網頁來執行任意程式碼。(CVE-2015-3730、CVE-2015-3731 CVE-2015-3732、CVE-2015-3733、CVE-2015-3734、CVE-2015-3735、CVE-2015-3736、CVE-2015-3737、CVE-2015-3738、CVE-2015-3739、CVE-2015-3740、CVE-2015-3741、CVE-2015-3742、CVE-2015-3743、CVE-2015-3744、CVE-2015-3745、CVE-2015-3746、CVE-2015-3747、CVE-2015-3748、CVE-2015-3749)

  - WebKit 中存有一個安全性原則繞過弱點，這與內容安全性原則報告要求的處理有關。攻擊者可利用此弱點繞過 HTTP Strict Transport Security 原則。(CVE-2015-3750)

  - WebKit 中存有一個安全性原則繞過弱點，允許網站違反內容安全性原則指示詞，使用視訊控制項來載入物件元素中巢狀的影像。(CVE-2015-3751)

  - WebKit 中存有一個資訊洩漏弱點，這與 cookie 新增至內容安全性原則報告要求的方式有關，會導致 cookie 被洩漏至跨來源要求。此外，正常瀏覽期間設定的 cookie 會在私密瀏覽時被傳送出去。(CVE-2015-3752)

  - WebKit Canvas 元件中存有一個資訊洩漏弱點，當使用重新導向至 data:image 資源的 URL 來呼叫影像時，就會觸發此弱點。攻擊者可利用此弱點，透過惡意網站洩漏跨來源的影像資料。(CVE-2015-3753)

  - WebKit 頁面載入中存在一個資訊洩漏弱點，在私密瀏覽模式下輸入的 HTTP 驗證認證在快取時會被傳遞至正常瀏覽，從而導致使用者的私密瀏覽歷程記錄遭洩漏。(CVE-2015-3754)

  - WebKit 處理程序模型中有一個瑕疵，允許惡意網站顯示任意 URL，進而導致使用者介面偽造。(CVE-2015-3755)

在 WebKitGTK+ Web 和 JavaScript 引擎中發現大量安全性問題。如果使用者遭到誘騙而檢視惡意網站，遠端攻擊者可利用多個與網頁瀏覽器安全性相關的問題，包括跨網站指令碼攻擊、拒絕服務攻擊和任意程式碼執行等。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The remote host is running a version of iOS that is prior to version 8.4.1 and the following components contain vulnerabilities :

 - Air Traffic 
 - AppleFileConduit 
 - Backup 
 - bootp 
 - CFPreferences 
 - Certificate UI 
 - CloudKit 
 - Code Signing 
 - CoreMedia Playback 
 - CoreText 
 - DiskImages 
 - FontParser 
 - IOHIDFamily 
 - IOKit 
 - ImageIO 
 - Kernel 
 - Libc 
 - Libinfo 
 - libpthread 
 - libxml2 
 - libxpc 
 - Location Framework 
 - MSVDX Driver 
 - MobileInstallation 
 - Office Viewer 
 - QL Office 
 - Safari 
 - Sandbox_profiles 
 - UIKit WebView 
 - Web 
 - WebKit 


Versions of Safari prior to 6.2.8 / 7.1.8 / 8.0.8 are reportedly affected by the following vulnerabilities :

 - An unspecified flaw exists that allows an attacker to spoof UI elements by using crafted web pages. (CVE-2015-3729)
 - Multiple memory corruption flaws exist in WebKit due to improper validation of user-supplied input. An attacker can exploit these, by using a crafted web page, to execute arbitrary code. (CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749)
 - A security policy bypass vulnerability exists in WebKit related to handling Content Security Policy report requests. An attacker can exploit this to bypass the HTTP Strict Transport Security policy. (CVE-2015-3750)
 - A security policy bypass vulnerability exists in WebKit that allows websites to use video controls to load images nested in object elements in violation of Content Security Policy directives. (CVE-2015-3751)
 - An information disclosure vulnerability exists in WebKit related to how cookies are added to Content Security Policy report requests, which results in cookies being exposed to cross-origin requests. Also, cookies set during regular browsing are sent during private browsing. (CVE-2015-3752)
 - An information disclosure vulnerability exists in the WebKit Canvas component when images are called using URLs that redirect to a data:image resource. An attacker, using a malicious website, can exploit this to disclose image data cross-origin. (CVE-2015-3753)
 - An information disclosure vulnerability exists in WebKit page loading where the caching of HTTP authentication credentials entered in private browsing mode were carried over into regular browsing, resulting in a user's private browsing history being exposed. (CVE-2015-3754)
 - A flaw in the WebKit process model allows a malicious website to display an arbitrary URL, which can allow user interface spoofing. (CVE-2015-3755)

Versions of iTunes earlier than 12.3 are affected by multiple vulnerabilities which include :

 - A flaw exists in Microsoft Foundation Class's handling of library loading due to the use of a fixed path.  An attacker can place a custom version of the file or library in the path, and the program will load it before the legitimate version.  Thus, an attacker can leverage this flaw to execute custom code. (CVE-2010-3190)
 - International Components for Unicode for C/C++ (ICU4C) contains several flaws.  An overflow condition exists in the resolveImplicitLevels() function in 'ubidi.c', which is triggered as user-supplied input is not properly validated. Additionally, an integer truncation flaw exists in the same function in 'ubidi.c'.   Either flaw may allow an attacker to crash an application linked against the library or potentially execute arbitrary code. (CVE-2014-8146, CVE-2014-8147, CVE-2015-5922)
 - A flaw exists in CoreText that is triggered as user-supplied input is not properly validated when handling text and font files. This may allow a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2015-1157, CVE-2015-5874, CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, CVE-2015-5755, CVE-2015-5761)
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-1152, CVE-2015-1153, CVE-2015-3730, CVE-2015-3731, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5796, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5808, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5821, CVE-2015-5822, CVE-2015-5823)
 - An unspecified flaw exists that is triggered during the handling of network connection redirects. This may allow a remote man-in-the-middle attacker to gain access to hashed SMB credential information. (CVE-2015-5920)

Versions of Apple TV earlier than 7.2.1 are unpatched for vulnerabilities in the following components :

 - bootp
 - CFPreferences
 - CloudKit
 - Code Signing
 - CoreMedia Playback
 - CoreText
 - DiskImages
 - FontParser
 - ImageIO
 - IOHIDFamily
 - IOKit
 - Kernel
 - Libc
 - Libinfo
 - libpthread
 - libxml2
 - libxpc
 - libxslt
 - Location Framework
 - Office Viewer
 - QL Office
 - Sandbox_profiles
 - WebKit

ID	名前	製品	ファミリー	公開日	更新日	深刻度
90104	Fedora 23：webkitgtk-2.4.10-1.fc23 (2016-5d6d75dbea)	Nessus	Fedora Local Security Checks	2016/3/23	2021/1/11	medium
90259	openSUSE 安全性更新：webkitgtk (openSUSE-2016-412)	Nessus	SuSE Local Security Checks	2016/4/1	2021/1/19	medium
85407	Apple iOS < 8.4.1 多個弱點	Nessus	Mobile Devices	2015/8/14	2024/5/20	high
85446	Mac OS X：Apple Safari < 6.2.8 / 7.1.8 / 8.0.8 多個弱點	Nessus	MacOS X Local Security Checks	2015/8/17	2018/7/14	medium
90094	Ubuntu 14.04 LTS：WebKitGTK+ 弱點 (USN-2937-1)	Nessus	Ubuntu Local Security Checks	2016/3/22	2023/10/20	high
90220	Fedora 24：webkitgtk-2.4.10-1.fc24 (2016-a4fcb02d6b)	Nessus	Fedora Local Security Checks	2016/3/28	2021/1/11	medium
8978	Apple iOS < 8.4.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2015/10/14	2019/3/6	critical
8949	Safari < 6.2.8 / 7.1.8 / 8.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/10/1	2019/3/6	high
8958	iTunes for Windows < 12.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/10/23	2019/3/6	high
9333	Apple TV < 7.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	2016/5/27	2019/3/6	low

検出

プラグインの検索

medium

medium

high

medium

high

medium

critical

high

high

low