The following vulnerabilities have been discovered in the webkit2gtk web engine :

  - CVE-2020-9802     Samuel Gross discovered that processing maliciously     crafted web content may lead to arbitrary code     execution.

  - CVE-2020-9803     Wen Xu discovered that processing maliciously crafted     web content may lead to arbitrary code execution.

  - CVE-2020-9805     An anonymous researcher discovered that processing     maliciously crafted web content may lead to universal     cross site scripting.

  - CVE-2020-9806     Wen Xu discovered that processing maliciously crafted     web content may lead to arbitrary code execution.

  - CVE-2020-9807     Wen Xu discovered that processing maliciously crafted     web content may lead to arbitrary code execution.

  - CVE-2020-9843     Ryan Pickren discovered that processing maliciously     crafted web content may lead to a cross site scripting     attack.

  - CVE-2020-9850     @jinmo123, @setuid0x0_, and @insu_yun_en discovered that     a remote attacker may be able to cause arbitrary code     execution.

  - CVE-2020-13753     Milan Crha discovered that an attacker may be able to     execute commands outside the bubblewrap sandbox.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0142-1 advisory.

    - Update to version 2.34.3 (bsc#1194019).
    - CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when     processing maliciously crafted web content.
    - CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously     crafted web content.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
138644	Debian DSA-4724-1 : webkit2gtk - security update	Nessus	Debian Local Security Checks	2020/7/20	2024/2/29	critical
156925	SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:0142-1)	Nessus	SuSE Local Security Checks	2022/1/21	2026/6/26	critical

検出

プラグインの検索

critical

critical