The version of Apple iTunes on the remote host is prior to version 10.0. It is, therefore, affected by multiple vulnerabilities in the WebKit component. Note that these only affect WebKit for Windows.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2011-34:01 advisory.

    WebKitGTK+ is the port of the portable web rendering engine WebKit to the     GTK+ platform.
    Security issues fixed with this release:
    CVE-2010-1780     Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and     Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via vectors related to element focus.
    CVE-2010-1782     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via vectors related to the rendering of an inline element.
    CVE-2010-1783     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, does not properly handle dynamic modification of a text node, which allows remote attackers to     execute arbitrary code or cause a denial of service (memory corruption and application crash) via a     crafted HTML document.
    CVE-2010-1784     The counters functionality in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari     before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote     attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash)     via a crafted HTML document.
    CVE-2010-1785     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, accesses uninitialized memory during processing of the (1) :first-letter and (2) :first-line     pseudo-elements in an SVG text element, which allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via a crafted document.
    CVE-2010-1786     Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and     Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via a foreignObject element in an SVG document.
    CVE-2010-1787     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via a floating element in an SVG document.
    CVE-2010-1788     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via a use element in an SVG document.
    CVE-2010-1790     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, does not properly handle just-in-time (JIT) compiled JavaScript stubs, which allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML     document, related to a 'reentrancy issue.'     CVE-2010-1792     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via a crafted regular expression.
    CVE-2010-1793     Multiple use-after-free vulnerabilities in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through     10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allow remote attackers to execute arbitrary code or     cause a denial of service (application crash) via a (1) font-face or (2) use element in an SVG document.
    CVE-2010-1807     WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2, and Android before 2.2, does not properly     validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of     service (application crash) via a crafted HTML document.
    CVE-2010-1812     Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving     selections.
    CVE-2010-1814     WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary     code or cause a denial of service (memory corruption and application crash) via vectors involving form     menus.
    CVE-2010-1815     CVE-2010-3113     Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving     scrollbars.
    CVE-2010-3114     Google Chrome before 5.0.375.127 does not properly handle SVG documents, which allows remote attackers to     cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown     vectors.
    CVE-2010-3115     The text-editing implementation in Google Chrome before 5.0.375.127 does not properly perform casts, which     has unspecified impact and attack vectors.
    CVE-2010-3116     Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before     5.0.3 and Google Chrome before 5.0.375.127, allow remote attackers to execute arbitrary code or cause a     denial of service (application crash) via vectors related to improper handling of MIME types by plug-ins.
    CVE-2010-3119     Google Chrome before 5.0.375.127 does not properly support the Ruby language, which allows attackers to     cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown     vectors.
    CVE-2010-3255     Google Chrome before 6.0.472.53 does not properly handle counter nodes, which allows remote attackers to     cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown     vectors.
    CVE-2010-3257     Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 and     Google Chrome before 6.0.472.53, allows remote attackers to execute arbitrary code or cause a denial of     service (application crash) via vectors involving element focus.
    CVE-2010-3259     WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 and Google Chrome before 6.0.472.53,     does not properly restrict read access to images derived from CANVAS elements, which allows remote     attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web     site.
    CVE-2010-3812     Integer overflow in the Text::wholeText method in dom/Text.cpp in WebKit, as used in Apple Safari before     5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before     1.2.6; and possibly other products allows remote attackers to execute arbitrary code or cause a denial of     service (application crash) via vectors involving Text objects.
    CVE-2010-3813     The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in     Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4;
    webkitgtk before 1.2.6; and possibly other products does not verify whether DNS prefetching is enabled     when processing an HTML LINK element, which allows remote attackers to bypass intended access     restrictions, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To     functionality.
    CVE-2010-4197     Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before     1.2.6, and other products, allows remote attackers to cause a denial of service or possibly have     unspecified other impact via vectors involving text editing.
    CVE-2010-4198     WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, does not     properly handle large text areas, which allows remote attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact via a crafted HTML document.
    CVE-2010-4204     WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a     frame object after this object has been destroyed, which allows remote attackers to cause a denial of     service or possibly have unspecified other impact via unknown vectors.
    CVE-2010-4206     Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in     WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows     remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SVG     document, related to effects in the application of filters.
    CVE-2010-4577     The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome     before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not     properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted local font, related to 'Type Confusion.'

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Gustavo Noronha Silva reports :

With help from Vincent Danen and other members of the Red Hat security team, the following CVE's where fixed.

Update to 1.2.4 which fixes: CVE-2010-1780 CVE-2010-1782 CVE-2010-1784 CVE-2010-1785 CVE-2010-1786 CVE-2010-1787 CVE-2010-1788 CVE-2010-1790 CVE-2010-1792 CVE-2010-1793 CVE-2010-2648

Update to 1.2.3 which fixes: CVE-2010-1386 CVE-2010-1392 CVE-2010-1405 CVE-2010-1407 CVE-2010-1416 CVE-2010-1417 CVE-2010-1665 CVE-2010-1418 CVE-2010-1421 CVE-2010-1422 CVE-2010-1501 CVE-2010-1767 CVE-2010-1664 CVE-2010-1758 CVE-2010-1759 CVE-2010-1760 CVE-2010-1761 CVE-2010-1762 CVE-2010-1770 CVE-2010-1771 CVE-2010-1772 CVE-2010-1773 CVE-2010-1774 CVE-2010-2264

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The browser engine libwebkit was updated to version 1.2.4 to fix several security bugs. (CVE-2010-1781, CVE-2010-1782, CVE-2010-1784, CVE-2010-1785 CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1790 CVE-2010-1792, CVE-2010-1793, CVE-2010-2648)

The remote host is affected by the vulnerability described in GLSA-201412-09 (Multiple packages, Multiple vulnerabilities fixed in 2011)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      FMOD Studio       PEAR Mail       LVM2       GnuCash       xine-lib       Last.fm Scrobbler       WebKitGTK+       shadow tool suite       PEAR       unixODBC       Resource Agents       mrouted       rsync       XML Security Library       xrdb       Vino       OProfile       syslog-ng       sFlow Toolkit       GNOME Display Manager       libsoup       CA Certificates       Gitolite       QtCreator       Racer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
49087	Apple iTunes < 10.0 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	2010/9/2	2018/11/15	high
284347	MiracleLinux 4 : webkitgtk-1.2.6-2.AXS4 (AXSA:2011-34:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	high
49189	FreeBSD : webkit-gtk2 -- Multiple vulnerabilities (9bcfd7b6-bcda-11df-9a6a-0015f2db7bde)	Nessus	FreeBSD Local Security Checks	2010/9/12	2021/1/6	critical
49295	Fedora 12 : webkitgtk-1.2.4-1.fc12 (2010-14419)	Nessus	Fedora Local Security Checks	2010/9/21	2021/1/11	high
75628	openSUSE Security Update : libwebkit (openSUSE-SU-2010:0666-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high
79962	GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011	Nessus	Gentoo Local Security Checks	2014/12/15	2025/2/28	critical
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	critical

检测

插件搜索

high

high

critical

high

high

critical

critical