The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:3713 advisory.

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2024-44192)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-54467)

    * webkitgtk: Processing web content may lead to a denial-of-service (CVE-2024-54551)

    * webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack (CVE-2025-24208)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2025-24209)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-24216)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2025-30427)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of webkitgtk4 installed on the remote host is prior to 2.48.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2970 advisory.

    A cookie management issue was addressed with improved state management. This issue is fixed in watchOS 11,     macOS Sequoia 15, Safari 18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. A malicious website may exfiltrate     data cross-origin. (CVE-2024-54467)

    The issue was addressed with improved checks. This issue is fixed in Safari 18.3, visionOS 2.3, iOS 18.3     and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously crafted web content     may lead to memory corruption. (CVE-2025-24189)

    This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.4, Safari 18.4,     iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A type confusion issue could lead to memory     corruption. (CVE-2025-24213)

    The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS     18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web     content may lead to memory corruption. (CVE-2025-24223)

    The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia     15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web     content may lead to memory corruption. (CVE-2025-31273)

    The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iPadOS 17.7.9,     watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing     maliciously crafted web content may lead to memory corruption. (CVE-2025-31278)

    The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia     15.6, iPadOS 17.7.9, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing web     content may lead to a denial-of-service. (CVE-2025-43211)

    The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, macOS Sequoia     15.6, iOS 18.6 and iPadOS 18.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web     content may lead to an unexpected Safari crash. (CVE-2025-43212)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.6,     watchOS 11.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, tvOS 18.6, macOS Sequoia 15.6, visionOS 2.6.
    Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2025-43216)

    This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6     and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted     web content may disclose sensitive user information. (CVE-2025-43227)

    The issue was addressed with improved UI. This issue is fixed in iOS 18.6 and iPadOS 18.6, Safari 18. 6.
    Visiting a malicious website may lead to address bar spoofing. (CVE-2025-43228)

    A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, Safari 18. 6.
    A download's origin may be incorrectly associated. (CVE-2025-43240)

    An out-of-bounds read was addressed with improved input validation. This issue is fixed in Safari 18.6,     watchOS 11.6, visionOS 2.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6. Processing     maliciously crafted web content may disclose internal states of the app. (CVE-2025-43265)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5885 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5885-1                   security@debian.org     https://www.debian.org/security/                           Alberto Garcia     March 23, 2025                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : webkit2gtk     CVE ID         : CVE-2024-44192 CVE-2024-54467 CVE-2025-24201

    The following vulnerabilities have been discovered in the WebKitGTK     web engine:

    CVE-2024-44192

        Tashita Software Security discovered that processing maliciously         crafted web content may lead to an unexpected process crash.

    CVE-2024-54467

        Narendra Bhati discovered that a malicious website may exfiltrate         data cross-origin.

    CVE-2025-24201

        Apple discovered that maliciously crafted web content may be able         to break out of Web Content sandbox.

    For the stable distribution (bookworm), these problems have been fixed in     version 2.48.0-1~deb12u1.

    We recommend that you upgrade your webkit2gtk packages.

    For the detailed security status of webkit2gtk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/webkit2gtk

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02777-1 advisory.

    Updated to version 2.48.5:
      - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to     memory corruption. (bsc#1247564)
      - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web content may lead to     memory corruption. (bsc#1247563)
      - CVE-2025-43211: Fixed a vulnerability where processing web content may lead to a denial-of-service.
    (bsc#1247562)
      - CVE-2025-43212: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247595)
      - CVE-2025-43216: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247596)
      - CVE-2025-43227: Fixed a vulnerability where processing maliciously crafted web content may disclose     sensitive user information. (bsc#1247597)
      - CVE-2025-43228: Fixed a vulnerability where visiting a malicious website may lead to address bar     spoofing. (bsc#1247598)
      - CVE-2025-43240: Fixed a vulnerability where a download's origin may be incorrectly associated.
    (bsc#1247599)
      - CVE-2025-43265: Fixed a vulnerability where processing maliciously crafted web content may disclose     internal states of the app. (bsc#1247600)
      - CVE-2025-6558: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247742)

    Other fixes:
    - Improve emoji font selection with USE_SKIA=ON.
    - Improve playback of multimedia streams from blob URLs.
    - Fix the build with USE_SKIA_OPENTYPE_SVG=ON and       USE_SYSPROF_CAPTURE=ON.
    - Fix crash when using a WebKitWebView widget in an offscreen       window.
    - Fix several crashes and rendering issues.
    - Fix a crash introduced by the new threaded rendering       implementation using Skia API.
    - Improve rendering performance by recording layers once and       replaying every dirty region in different worker threads.
    - Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
    - Fix a reference cycle in webkitmediastreamsrc preventing its       disposal.
    - Increase mem_per_process again to avoid running out of memory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
243092	RockyLinux 9 : webkit2gtk3 (RLSA-2025:3713)	Nessus	Rocky Linux Local Security Checks	2025/7/30	2025/7/30	medium
252299	Amazon Linux 2 : webkitgtk4 (ALAS-2025-2970)	Nessus	Amazon Linux Local Security Checks	2025/8/19	2025/8/19	medium
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2026/11/5	critical
233282	Debian dsa-5885 : gir1.2-javascriptcoregtk-4.0 - security update	Nessus	Debian Local Security Checks	2025/3/23	2025/3/23	high
278687	SUSE SLES15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2025:02777-1)	Nessus	SuSE Local Security Checks	2025/12/15	2026/6/26	critical

検出

プラグインの検索

medium

medium

critical

high

critical