According to its version, the iCloud application installed on the remote Windows host is 10.x prior to 10.8. It is, therefore, affected by multiple vulnerabilities:

  - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to multiple memory     corruption issues. An unauthenticated, remote attacker can exploit this to execute arbitrary code.     (CVE-2019-8710, CVE-2019-8766, CVE-2019-8782, CVE-2019-8783, CVE-2019-8784, CVE-2019-8811, CVE-2019-8814,     CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)

  - Multiple issues exist with in the Libxslt due to multiple memory corruption issue. (CVE-2019-8750)

  - An cross site scripting vulnerability exist with in the WebKit due to logic issue. An unauthenticated,     remote attacker can exploit this by processing maliciously crafted web content may lead to universal     cross site scripting. (CVE-2019-8813)

  - An arbitrary code execution vulnerability exist with in the WebKit due to multiple memory corruption     issue. An unauthenticated, remote attacker can exploit this by processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2019-8815)

Security Fix(es) :

  - webkitgtk: Multiple security issues (CVE-2019-6237,     CVE-2019-6251, CVE-2019-8506, CVE-2019-8524,     CVE-2019-8535, CVE-2019-8536, CVE-2019-8544,     CVE-2019-8551, CVE-2019-8558, CVE-2019-8559,     CVE-2019-8563, CVE-2019-8571, CVE-2019-8583,     CVE-2019-8584, CVE-2019-8586, CVE-2019-8587,     CVE-2019-8594, CVE-2019-8595, CVE-2019-8596,     CVE-2019-8597, CVE-2019-8601, CVE-2019-8607,     CVE-2019-8608, CVE-2019-8609, CVE-2019-8610,     CVE-2019-8611, CVE-2019-8615, CVE-2019-8619,     CVE-2019-8622, CVE-2019-8623, CVE-2019-8625,     CVE-2019-8644, CVE-2019-8649, CVE-2019-8658,     CVE-2019-8666, CVE-2019-8669, CVE-2019-8671,     CVE-2019-8672, CVE-2019-8673, CVE-2019-8674,     CVE-2019-8676, CVE-2019-8677, CVE-2019-8678,     CVE-2019-8679, CVE-2019-8680, CVE-2019-8681,     CVE-2019-8683, CVE-2019-8684, CVE-2019-8686,     CVE-2019-8687, CVE-2019-8688, CVE-2019-8689,     CVE-2019-8690, CVE-2019-8707, CVE-2019-8710,     CVE-2019-8719, CVE-2019-8720, CVE-2019-8726,     CVE-2019-8733, CVE-2019-8735, CVE-2019-8743,     CVE-2019-8763, CVE-2019-8764, CVE-2019-8765,     CVE-2019-8766, CVE-2019-8768, CVE-2019-8769,     CVE-2019-8771, CVE-2019-8782, CVE-2019-8783,     CVE-2019-8808, CVE-2019-8811, CVE-2019-8812,     CVE-2019-8813, CVE-2019-8814, CVE-2019-8815,     CVE-2019-8816, CVE-2019-8819, CVE-2019-8820,     CVE-2019-8821, CVE-2019-8822, CVE-2019-8823,     CVE-2019-8835, CVE-2019-8844, CVE-2019-8846,     CVE-2019-11070, CVE-2020-3862, CVE-2020-3864,     CVE-2020-3865, CVE-2020-3867, CVE-2020-3868,     CVE-2020-3885, CVE-2020-3894, CVE-2020-3895,     CVE-2020-3897, CVE-2020-3899, CVE-2020-3900,     CVE-2020-3901, CVE-2020-3902, CVE-2020-10018,     CVE-2020-11793)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4035 advisory.

  - WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings     when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization.
    This issue was corrected by changing the way livestreams are downloaded. (CVE-2019-11070)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-6237,     CVE-2019-8571, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596,     CVE-2019-8597, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611, CVE-2019-8615, CVE-2019-8619)

  - WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain     JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted     URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge. (CVE-2019-6251)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS     12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2019-8506)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2019-8524)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2,     tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2019-8535)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2,     tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8536, CVE-2019-8544)

  - A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari     12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may     lead to universal cross site scripting. (CVE-2019-8551)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8558, CVE-2019-8559,     CVE-2019-8563)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for     Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8583, CVE-2019-8601, CVE-2019-8622, CVE-2019-8623)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS     Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows     7.12. Processing maliciously crafted web content may result in the disclosure of process memory.
    (CVE-2019-8607)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for     Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8625, CVE-2019-8719)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13,     iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8644, CVE-2019-8666, CVE-2019-8671, CVE-2019-8673, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679,     CVE-2019-8680, CVE-2019-8681, CVE-2019-8686, CVE-2019-8687)

  - A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved     state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes     for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8649)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave     10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud     for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2019-8658)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for     Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8669, CVE-2019-8672, CVE-2019-8676, CVE-2019-8683, CVE-2019-8684, CVE-2019-8688,     CVE-2019-8689)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13.
    Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8674)

  - A logic issue existed in the handling of document loads. This issue was addressed with improved state     management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for     Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8690)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8707, CVE-2019-8726,     CVE-2019-8733, CVE-2019-8735)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8710)

  - A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content     that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory     corruption issues. (CVE-2019-8720)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8743, CVE-2019-8765)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud     for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8763)

  - A logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing     maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8764)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8766)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history     items. (CVE-2019-8768)

  - An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This     issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website     may reveal browsing history. (CVE-2019-8769)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1,     iOS 13. Maliciously crafted web content may violate iframe sandboxing policy. (CVE-2019-8771)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8782)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0,     iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8783, CVE-2019-8814, CVE-2019-8815, CVE-2019-8819, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8808, CVE-2019-8812)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for     Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8811, CVE-2019-8816, CVE-2019-8820)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS     13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing     maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8813)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows,     iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8835)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3     for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8844)

  - A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3,     iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for     Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8846)

  - WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0)     contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue     has been fixed in 2.28.0 with improved memory handling. (CVE-2020-10018)

  - A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web     content that allows remote attackers to execute arbitrary code or cause a denial of service (memory     corruption and application crash). (CVE-2020-11793)

  - A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1     and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud     for Windows 7.17. A malicious website may be able to cause a denial of service. (CVE-2020-3862)

  - A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17,     iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS     13.3.1. A DOM object context may not have had a unique security origin. (CVE-2020-3864)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0,     iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3865, CVE-2020-3868)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS     13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for     Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2020-3867)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4,     tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A     file URL may be incorrectly processed. (CVE-2020-3885)

  - A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS     13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows     7.18. An application may be able to read restricted memory. (CVE-2020-3894)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3895, CVE-2020-3900)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. (CVE-2020-3897)

  - A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows     10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.
    (CVE-2020-3899)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3901)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for     Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.
    (CVE-2020-3902)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30666)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30761)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30762)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

移动设备上运行的 Apple iOS 版本低于 13.2。因此，该主机受到多个漏洞的影响。
  - iOS 帐户中存在内存泄露漏洞，远程攻击者可通过特别构建的输入来利用此漏洞。(CVE-2019-8787)

  - iOS App 商店中存在身份验证漏洞，本地攻击者可在没有有效凭据的情况下登录先前登录的用户帐户。(CVE-2019-8803)

  - 相关域容易遭受数据外泄。攻击者可通过不当 URL 利用此问题。URL 的解析中存在问题。(CVE-2019-8788)

  - iOS Audio 和 AVEVideoEncoder 中存在内存损坏问题。应用程序可能以系统权限执行任意代码。（CVE-2019-8785、CVE-2019-8797、CVE-2019-8795）

  - 处理 iOS Books 中的 symlink 时存在验证问题。解析恶意构建的 iBooks 文件可能导致用户信息泄露。(CVE-2019-8789)

  - iOS 联系人中存在不一致的用户界面问题，处理恶意联系人可导致 UI 欺骗。(CVE-2017-7152)

  - iOS 文件系统事件、图形卡驱动程序、内核中存在内存损坏问题。应用程序可能以系统权限执行任意代码。（CVE-2019-8798、CVE-2019-8784、CVE-2019-8786）

  - iOS 内核中存在输入验证问题。应用程序可以读取受限内存。
    (CVE-2019-8794)

  - iOS“设置助理”的 Wi-Fi 网络配置中存在的不一致问题易受到影响。物理邻近攻击者能够迫使用户在设备设置期间进行恶意 Wi-Fi 连接。(CVE-2019-8804)

  - iOS 屏幕录制容易受到攻击，本地用户也许能够录制屏幕，而无需可见的屏幕录制指示器。(CVE-2019-8793)

  - 由于在将用户提供的输入返回给用户前未对其进行正确验证，导致 iOS WebKit 中存在跨站脚本 (XSS) 漏洞。处理恶意构建的 Web 内容可能会导致通用跨站脚本攻击。(CVE-2019-8813)

  - iOS WebKit 和 WebKit 处理模型中存在任意代码执行漏洞。处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行。
   （CVE-2019-8783、CVE-2019-8808、CVE-2019-8811、CVE-2019-8812、CVE-2019-8814、CVE-2019-8816、CVE-2019-8819、CVE-2019-8820、CVE-2019-8821、CVE-2019-8822、CVE-2019-8823、CVE-2019-8815、CVE-2019-8782）

  - 处理状态过渡时存在逻辑问题，可允许 Wi-Fi 范围内的攻击者危害网络流量的某一机密性。(CVE-2019-15126)

  - HTTP 引荐来源标头向恶意构建的网站泄露浏览历史记录。(CVE-2019-8827)

  - 存在一个内存损坏漏洞，可允许应用程序以内核权限执行任意代码。(CVE-2019-8829)

运行 CORE 5.05 / MAIN 5.05 版本的远程 NewStart CGSL 主机上安装的 webkitgtk4 程序包受到多个漏洞的影响：

  - 下载实时流视频（HLS、DASH 或 Smooth Streaming）时，WebKitGTK 和 WPE WebKit 2.24.1 之前版本未正确应用已配置的 HTTP 代理设置，此错误会导致去匿名化。
    此问题已通过更改下载实时流的方式予以修正。(CVE-2019-11070)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 12.3、macOS Mojave 10.14.5、tvOS 12.3、Safari 12.1.1、Windows 版 iTunes 12.9.5、Windows 版 iCloud 7.12 中修复。
    处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-6237、CVE-2019-8571、CVE-2019-8584、CVE-2019-8586、CVE-2019-8587、CVE-2019-8594、CVE-2019-8595、CVE-2019-8596、CVE-2019-8597、CVE-2019-8608、CVE-2019-8609、CVE-2019-8610、CVE-2019-8611、CVE-2019-8615、CVE-2019-8619）

  - WebKitGTK 和 WPE WebKit 2.24.1 之前版本容易受到某些 JavaScript 重定向中地址栏欺骗的攻击。攻击者可造成恶意 Web 内容的显示方式如同受信任的 URI 一样。此问题与 Microsoft Edge 中 CVE-2018-8383 问题相似。(CVE-2019-6251)

  - 已通过改进的内存管理解决释放后使用问题。此问题已在 iOS 12.2、tvOS 12.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。(CVE-2019-7285)

  - 已通过改进的逻辑解决验证问题。此问题已在 iOS 12.2、tvOS 12.2、watchOS 5.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。处理恶意构建的 Web 内容可能导致进程内存泄漏。(CVE-2019-7292)

  - 已通过改进的验证解决逻辑问题。此问题已在 iOS 12.2、tvOS 12.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。恶意网站可能在其他网站的环境中执行脚本。(CVE-2019-8503)

  - 已通过改进的内存处理解决类型混淆问题。此问题已在 iOS 12.2、tvOS 12.2、watchOS 5.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。(CVE-2019-8506)

  - fetch API 中存在跨源问题。已通过改进输入验证解决此问题。此问题已在 iOS 12.2、tvOS 12.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。
    处理恶意构建的 Web 内容可能会泄露敏感用户信息。(CVE-2019-8515)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 12.2、tvOS 12.2、watchOS 5.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-8518、CVE-2019-8558、CVE-2019-8559、CVE-2019-8563）

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 12.2、tvOS 12.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-8523、CVE-2019-8524）

  - 已通过改进的状态管理解决内存损坏问题。此问题已在 iOS 12.2、tvOS 12.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。(CVE-2019-8535)

  - 已通过改进的内存处理解决内存损坏问题。此问题已在 iOS 12.2、tvOS 12.2、watchOS 5.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-8536、CVE-2019-8544）

  - 已通过改进的验证解决逻辑问题。此问题已在 iOS 12.2、tvOS 12.2、Safari 12.1、Windows 版 iTunes 12.9.4、Windows 版 iCloud 7.11 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。(CVE-2019-8551)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 12.3、macOS Mojave 10.14.5、tvOS 12.3、watchOS 5.2.1、Safari 12.1.1、Windows 版 iTunes 12.9.5、Windows 版 iCloud 7.12 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    （CVE-2019-8583、CVE-2019-8601、CVE-2019-8622、CVE-2019-8623）

  - 已通过改进的状态管理解决逻辑问题。此问题已在 tvOS 13、Windows 版 iTunes 12.10.1、Windows 版 iCloud 10.7、Windows 版 iCloud 7.14 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。（CVE-2019-8625、CVE-2019-8719）

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 12.4、macOS Mojave 10.14.6、tvOS 12.4、Safari 12.1.2、Windows 版 iTunes 12.9.6、Windows 版 iCloud 7.13、Windows 版 iCloud 10.6 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    （CVE-2019-8644、CVE-2019-8666、CVE-2019-8671、CVE-2019-8673、CVE-2019-8677、CVE-2019-8678、CVE-2019-8679、CVE-2019-8680、CVE-2019-8681、CVE-2019-8686、CVE-2019-8687）

  - 处理同步页面加载的过程中存在逻辑问题。- 已通过改进的状态管理解决此问题。此问题已在 iOS 12.4、macOS Mojave 10.14.6、tvOS 12.4、Safari 12.1.2、Windows 版 iTunes 12.9.6、Windows 版 iCloud 7.13、Windows 版 iCloud 10.6 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。(CVE-2019-8649)

  - 已通过改进的状态管理解决逻辑问题。此问题已在 iOS 12.4、macOS Mojave 10.14.6、tvOS 12.4、watchOS 5.3、Safari 12.1.2、Windows 版 iTunes 12.9.6、Windows 版 iCloud 7.13、Windows 版 iCloud 10.6 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。
    (CVE-2019-8658)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 12.4、macOS Mojave 10.14.6、tvOS 12.4、watchOS 5.3、Safari 12.1.2、Windows 版 iTunes 12.9.6、Windows 版 iCloud 7.13、Windows 版 iCloud 10.6 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-8669、CVE-2019-8672、CVE-2019-8676、CVE-2019-8683、CVE-2019-8684、CVE-2019-8688、CVE-2019-8689）

  - 已通过改进的状态管理解决逻辑问题。此问题已在 iOS 13、Safari 13 中修复。
    处理恶意构建的 Web 内容可能会导致通用跨站脚本。(CVE-2019-8674)

  - 处理文档加载的过程中存在逻辑问题。- 已通过改进的状态管理解决此问题。此问题已在 iOS 12.4、macOS Mojave 10.14.6、tvOS 12.4、Safari 12.1.2、Windows 版 iTunes 12.9.6、Windows 版 iCloud 7.13、Windows 版 iCloud 10.6 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。(CVE-2019-8690)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 tvOS 13、Windows 版 iTunes 12.10.1、Windows 版 iCloud 10.7、Windows 版 iCloud 7.14 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-8707、CVE-2019-8726、CVE-2019-8733、CVE-2019-8735）

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 Windows 版 iCloud 11.0 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    (CVE-2019-8710)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 watchOS 6.1 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    （CVE-2019-8743、CVE-2019-8765）

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 13.1 和 iPadOS 13.1、tvOS 13、Safari 13.0.1、Windows 版 iTunes 12.10.1、Windows 版 iCloud 10.7、Windows 版 iCloud 7.14 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    (CVE-2019-8763)

  - 已通过改进的状态管理解决逻辑问题。此问题已在 watchOS 6.1 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。(CVE-2019-8764)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 watchOS 6.1、Windows 版 iCloud 11.0 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。(CVE-2019-8766)

  - “清除历史记录和网站数据”功能未清除历史记录。已通过改进的数据删除解决此问题。此问题已在 macOS Catalina 10.15 中修复。用户可能无法删除浏览历史记录项目。(CVE-2019-8768)

  - 网页元素绘制中存在问题。已通过改进的逻辑解决此问题。此问题已在 iOS 13.1 和 iPadOS 13.1、macOS Catalina 10.15 中修复。浏览恶意构建的网站可能会泄露浏览历史记录。(CVE-2019-8769)

  - 此问题已通过改进的 iframe 沙盒执行解决。此问题已在 Safari 13.0.1、iOS 13 中修复。恶意构建的 Web 内容可能会违反 iframe 沙盒策略。(CVE-2019-8771)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 13.2 和 iPadOS 13.2、tvOS 13.2、Safari 13.0.3、Windows 版 iTunes 12.10.2、Windows 版 iCloud 11.0 中修复。
    - 处理恶意构建的 Web 内容可能会导致任意代码执行。(CVE-2019-8782)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 13.2 和 iPadOS 13.2、tvOS 13.2、Safari 13.0.3、Windows 版 iTunes 12.10.2、Windows 版 iCloud 11.0、Windows 版 iCloud 7.15 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    （CVE-2019-8783、CVE-2019-8814、CVE-2019-8815、CVE-2019-8819、CVE-2019-8821、CVE-2019-8822、CVE-2019-8823）

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 13.2 和 iPadOS 13.2、tvOS 13.2、watchOS 6.1、Safari 13.0.3、Windows 版 iTunes 12.10.2 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-8808、CVE-2019-8812）

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 13.2 和 iPadOS 13.2、tvOS 13.2、watchOS 6.1、Safari 13.0.3、Windows 版 iTunes 12.10.2、Windows 版 iCloud 11.0、Windows 版 iCloud 7.15 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。（CVE-2019-8811、CVE-2019-8816、 CVE-2019-8820）

  - 已通过改进的状态管理解决逻辑问题。此问题已在 iOS 13.2 和 iPadOS 13.2、tvOS 13.2、Safari 13.0.3、Windows 版 iTunes 12.10.2、Windows 版 iCloud 11.0 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。(CVE-2019-8813)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 tvOS 13.3、Windows 版 iCloud 10.9、iOS 13.3 和 iPadOS 13.3、Safari 13.0.4、Windows 版 iTunes 12.10.3、Windows 版 iCloud 7.16 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    (CVE-2019-8835)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 tvOS 13.3、watchOS 6.1.1、Windows 版 iCloud 10.9、iOS 13.3 和 iPadOS 13.3、Safari 13.0.4、Windows 版 iTunes 12.10.3、Windows 版 iCloud 7.16 中修复。- 处理恶意构建的 Web 内容可能会导致任意代码执行。(CVE-2019-8844)

  - 已通过改进的内存管理解决释放后使用问题。此问题已在 tvOS 13.3、Windows 版 iCloud 10.9、iOS 13.3 和 iPadOS 13.3、Safari 13.0.4、Windows 版 iTunes 12.10.3、Windows 版 iCloud 7.16 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    (CVE-2019-8846)

  - WebKitGTK 2.26.4 及其之前版本和 WPE WebKit 2.26.4 及其之前版本（2.28.0 之前版本）包含内存损坏问题（释放后使用），可能导致任意代码执行。已通过改进的内存处理在 2.28.0 中修复此问题。(CVE-2020-10018)

  - WebKitGTK 2.28.1 之前版本和 WPE WebKit 2.28.1 之前版本中存在释放后使用问题，远程攻击者可利用此问题，通过构建的 Web 内容执行任意代码或造成拒绝服务（内存破坏和应用程序崩溃）。 (CVE-2020-11793)

  - 已通过改进的内存处理解决拒绝服务问题。此问题已在 iOS 13.3.1 和 iPadOS 13.3.1、tvOS 13.3.1、Safari 13.0.5、Windows 版 iTunes 12.10.4、Windows 版 iCloud 11.0、Windows 版 iCloud 7.17 中修复。恶意网站或可造成拒绝服务。(CVE-2020-3862)

  - 已通过改进的验证解决逻辑问题。此问题已在 iCloud for Windows 7.17、Windows 版 iTunes 12.10.4、Windows 版 iCloud 10.9.2、tvOS 13.3.1、Safari 13.0.5、iOS 13.3.1 和 iPadOS 13.3.1 中修复。DOM 对象上下文可能没有唯一安全源。(CVE-2020-3864)

  - 已通过改进的内存处理解决多个内存损坏问题。此问题已在 iOS 13.3.1 和 iPadOS 13.3.1、tvOS 13.3.1、Safari 13.0.5、Windows 版 iTunes 12.10.4、Windows 版 iCloud 11.0、Windows 版 iCloud 7.17 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    （CVE-2020-3865、CVE-2020-3868）

  - 已通过改进的状态管理解决逻辑问题。此问题已在 iOS 13.3.1 和 iPadOS 13.3.1、tvOS 13.3.1、Safari 13.0.5、Windows 版 iTunes 12.10.4、Windows 版 iCloud 11.0、Windows 版 iCloud 7.17 中修复。处理恶意构建的 Web 内容可能会导致通用跨站脚本。
    (CVE-2020-3867)

  - 已通过改进的限制解决逻辑问题。此问题已在 iOS 13.4 和 iPadOS 13.4、tvOS 13.4、Safari 13.1、Windows 版 iTunes 12.10.5、Windows 版 iCloud 10.9.3、Windows 版 iCloud 7.18 中修复。可能未正确处理文件 URL。(CVE-2020-3885)

  - 已通过额外验证解决争用条件。此问题已在 iOS 13.4 和 iPadOS 13.4、tvOS 13.4、Safari 13.1、Windows 版 iTunes 12.10.5、Windows 版 iCloud 10.9.3、Windows 版 iCloud 7.18 中修复。应用程序或可读取受限内存。(CVE-2020-3894)

  - 已通过改进的内存处理解决内存损坏问题。此问题已在 iOS 13.4 和 iPadOS 13.4、tvOS 13.4、watchOS 6.2、Safari 13.1、Windows 版 iTunes 12.10.5、Windows 版 iCloud 10.9.3、Windows 版 iCloud 7.18 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    （CVE-2020-3895、CVE-2020-3900）

  - 已通过改进的内存处理解决类型混淆问题。此问题已在 iOS 13.4 和 iPadOS 13.4、tvOS 13.4、watchOS 6.2、Safari 13.1、Windows 版 iTunes 12.10.5、Windows 版 iCloud 10.9.3、Windows 版 iCloud 7.18 中修复。远程攻击者或可造成任意代码执行。（CVE-2020-3897）

  - 已通过改进的内存处理解决内存消耗问题。此问题已在 iOS 13.4 和 iPadOS 13.4、tvOS 13.4、watchOS 6.2、Safari 13.1、Windows 版 iTunes 12.10.5、Windows 版 iCloud 10.9.3、Windows 版 iCloud 7.18 中修复。远程攻击者或可造成任意代码执行。
    (CVE-2020-3899)

  - 已通过改进的内存处理解决类型混淆问题。此问题已在 iOS 13.4 和 iPadOS 13.4、tvOS 13.4、watchOS 6.2、Safari 13.1、Windows 版 iTunes 12.10.5、Windows 版 iCloud 10.9.3、Windows 版 iCloud 7.18 中修复。处理恶意构建的 Web 内容可能会导致任意代码执行。
    (CVE-2020-3901)

  - 已通过改进的输入验证解决输入验证问题。此问题已在 iOS 13.4 和 iPadOS 13.4、tvOS 13.4、Safari 13.1、Windows 版 iTunes 12.10.5、Windows 版 iCloud 10.9.3、Windows 版 iCloud 7.18 中修复。处理恶意构建的 Web 内容可能会导致跨站脚本攻击。
    (CVE-2020-3902)

  - 已通过改进的内存处理解决缓冲溢出问题。已在 iOS 12.5.3 中修复此问题。
    处理恶意构建的 Web 内容可能会导致任意代码执行。Apple 从报告中获悉，此问题可能已经被主动利用。(CVE-2021-30666)

  - 已通过改进的状态管理解决内存损坏问题。已在 iOS 12.5.4 中修复此问题。
    处理恶意构建的 Web 内容可能会导致任意代码执行。Apple 从报告中获悉，此问题可能已经被主动利用。(CVE-2021-30761)

  - 已通过改进的内存管理解决释放后使用问题。已在 iOS 12.5.4 中修复此问题。
    处理恶意构建的 Web 内容可能会导致任意代码执行。Apple 从报告中获悉，此问题可能已经被主动利用。(CVE-2021-30762)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程主机受到 GLSA-202003-22 中所述漏洞的影响（WebkitGTK+：多个漏洞）在 WebKitGTK+ 中发现多个漏洞。如需详细信息，请查看供参考的 CVE 标识符。影响：远程攻击者可执行任意代码、造成拒绝服务情况、绕过预定的内存读取限制、发动边信道时序攻击以绕过同源策略或取得敏感信息。解决方法：目前无任何已知的解决方法。

根据其版本，远程 Windows 主机上安装的 iCloud 应用程序为低于 7.15 的 7.x。因此，该应用程序受到多个漏洞的影响：

  - WebKit 中存在多个任意代码执行漏洞，这是多个内存损坏问题所致。未经身份验证的远程攻击者可利用此问题执行任意代码。（CVE-2019-8783、CVE-2019-8784、CVE-2019-8811、CVE-2019-8814、CVE-2019-8815、CVE-2019-8816、CVE-2019-8819、CVE-2019-8820、CVE-2019-8821、CVE-2019-8822、CVE-2019-8823）

此更新修复了 webkit2gtk3 2.26.2 及之前版本中的下列问题：Webkit2gtk3 更新到了 2.26.2 版本（WSA-2019-0005 和 WSA-2019-0006，bsc#1155321 bsc#1156318）解决的安全问题：- CVE-2019-8625：修复了处理恶意构建的 Web 内容，会导致通用跨站脚本的逻辑问题。- CVE-2019-8674：修复了处理恶意构建的 Web 内容，会导致通用跨站脚本的逻辑问题。- CVE-2019-8707：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8719：修复了处理恶意构建的 Web 内容，会导致通用跨站脚本的逻辑问题。- CVE-2019-8720：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8726：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8733：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8735：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8763：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8768：修复了用户可能无法删除浏览历史记录项目的问题。- CVE-2019-8769：修复了恶意构建的网站可能会泄露浏览历史记录的问题。- CVE-2019-8771：修复了恶意构建的 Web 内容可能会违反 iframe 沙盒策略的问题。- CVE-2019-8710：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8743：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8764：修复了处理恶意构建的 Web 内容，会导致通用跨站脚本的逻辑问题。- CVE-2019-8765：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8766：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8782：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8783：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8808：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8811：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8812：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8813：修复了处理恶意构建的 Web 内容，会导致通用跨站脚本的逻辑问题。- CVE-2019-8814：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8815：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8816：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8819：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8820：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8821：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8822：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。- CVE-2019-8823：修复了处理恶意构建的 Web 内容时，多个内存损坏可能导致任意代码执行的多个内存损坏问题。此更新从 SUSE:SLE-15:Update 更新项目导入。

This update for webkit2gtk3 to version 2.26.2 fixes the following issues :

Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318) 

Security issues addressed :

  - CVE-2019-8625: Fixed a logic issue where by processing     maliciously crafted web content may lead to universal     cross site scripting. 

  - CVE-2019-8674: Fixed a logic issue where by processing     maliciously crafted web content may lead to universal     cross site scripting.

  - CVE-2019-8707: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8719: Fixed a logic issue where by processing     maliciously crafted web content may lead to universal     cross site scripting.

  - CVE-2019-8720: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8726: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8733: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8735: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8763: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8768: Fixed an issue where a user may be unable     to delete browsing history items.

  - CVE-2019-8769: Fixed an issue where a maliciously     crafted website may reveal browsing history.

  - CVE-2019-8771: Fixed an issue where a maliciously     crafted web content may violate iframe sandboxing     policy.

  - CVE-2019-8710: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8743: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8764: Fixed a logic issue where by processing     maliciously crafted web content may lead to universal     cross site scripting.

  - CVE-2019-8765: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8766: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8782: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8783: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8808: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8811: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8812: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8813: Fixed a logic issue where by processing     maliciously crafted web content may lead to universal     cross site scripting.

  - CVE-2019-8814: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8815: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8816: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8819: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8820: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8821: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8822: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

  - CVE-2019-8823: Fixed multiple memory corruption issues     where by processing maliciously crafted web content may     lead to arbitrary code execution.

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has webkitgtk4 packages installed that are affected by multiple vulnerabilities:

  - WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings     when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization.
    This issue was corrected by changing the way livestreams are downloaded. (CVE-2019-11070)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-6237,     CVE-2019-8571, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596,     CVE-2019-8597, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611, CVE-2019-8615, CVE-2019-8619)

  - WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain     JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted     URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge. (CVE-2019-6251)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2,     tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2019-7285)

  - A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS     5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web     content may result in the disclosure of process memory. (CVE-2019-7292)

  - A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari     12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute     scripts in the context of another website. (CVE-2019-8503)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS     12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2019-8506)

  - A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This     issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11.
    Processing maliciously crafted web content may disclose sensitive user information. (CVE-2019-8515)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8518, CVE-2019-8558,     CVE-2019-8559, CVE-2019-8563)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2019-8523, CVE-2019-8524)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2,     tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2019-8535)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2,     tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8536, CVE-2019-8544)

  - A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari     12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may     lead to universal cross site scripting. (CVE-2019-8551)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for     Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8583, CVE-2019-8601, CVE-2019-8622, CVE-2019-8623)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for     Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8625, CVE-2019-8719)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13,     iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8644, CVE-2019-8666, CVE-2019-8671, CVE-2019-8673, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679,     CVE-2019-8680, CVE-2019-8681, CVE-2019-8686, CVE-2019-8687)

  - A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved     state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes     for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8649)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave     10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud     for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2019-8658)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for     Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8669, CVE-2019-8672, CVE-2019-8676, CVE-2019-8683, CVE-2019-8684, CVE-2019-8688,     CVE-2019-8689)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13.
    Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8674)

  - A logic issue existed in the handling of document loads. This issue was addressed with improved state     management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for     Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8690)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8707, CVE-2019-8726,     CVE-2019-8733, CVE-2019-8735)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8710)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8743, CVE-2019-8765)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud     for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8763)

  - A logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing     maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8764)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8766)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history     items. (CVE-2019-8768)

  - An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This     issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website     may reveal browsing history. (CVE-2019-8769)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1,     iOS 13. Maliciously crafted web content may violate iframe sandboxing policy. (CVE-2019-8771)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8782)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0,     iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8783, CVE-2019-8814, CVE-2019-8815, CVE-2019-8819, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8808, CVE-2019-8812)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for     Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8811, CVE-2019-8816, CVE-2019-8820)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS     13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing     maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8813)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows,     iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8835)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3     for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8844)

  - A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3,     iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for     Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8846)

  - WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0)     contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue     has been fixed in 2.28.0 with improved memory handling. (CVE-2020-10018)

  - A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web     content that allows remote attackers to execute arbitrary code or cause a denial of service (memory     corruption and application crash). (CVE-2020-11793)

  - A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1     and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud     for Windows 7.17. A malicious website may be able to cause a denial of service. (CVE-2020-3862)

  - A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17,     iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS     13.3.1. A DOM object context may not have had a unique security origin. (CVE-2020-3864)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0,     iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3865, CVE-2020-3868)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS     13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for     Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2020-3867)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4,     tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A     file URL may be incorrectly processed. (CVE-2020-3885)

  - A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS     13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows     7.18. An application may be able to read restricted memory. (CVE-2020-3894)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3895, CVE-2020-3900)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. (CVE-2020-3897)

  - A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows     10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.
    (CVE-2020-3899)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3901)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for     Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.
    (CVE-2020-3902)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30666)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30761)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 13.2. It is, therefore, affected by multiple vulnerabilities.
  - A memory leak vulnerablity exists in the iOS Accounts, a remote attacker can exploit this using specially     crafted input. (CVE-2019-8787)

  - An authentication vulnerability exists in the iOS App store, a local attacker may be able to login to the     account of a previously logged in user without valid credentials. (CVE-2019-8803)

  - Associated Domains vulnerable to data exfiltration. The attacker can exploit this issue by passing improper     URL. An issue existed in the parsing of URLs. (CVE-2019-8788)

  - A memory corruption issue exist in iOS Audio and AVEVideoEncoder. An application may be able to execute     arbitrary code with system privileges. (CVE-2019-8785, CVE-2019-8797, CVE-2019-8795)

  - A validation issue existed in the handling of symlinks in iOS Books. Parsing a maliciously crafted iBooks file     may lead to disclosure of user information. (CVE-2019-8789)

  - An inconsistent user interface issue exist in the iOS Contacts, processing a maliciously contact may lead to     UI spoofing. (CVE-2017-7152)

  - A memory corruption issue exists in the iOS File System Events, Graphics Driver, Kernel. An application may     be able to execute arbitrary code with system privileges. (CVE-2019-8798, CVE-2019-8784, CVE-2019-8786)

  - An input validation exists in the iOS Kernel. An application may be able to read restricted memory.
    (CVE-2019-8794)

  - An inconsistency in Wi-Fi network configuration in iOS Setup Assistant is vulnerable. An attacker in physical     proximity may be able to force a user onto a malicious Wi-Fi network during device setup. (CVE-2019-8804)

  - A iOS Screen Recording is vulnerable, a local user may be able to record the screen without a visible screen     recording indicator. (CVE-2019-8793)

  - A cross-site scripting (XSS) vulnerability exists in iOS WebKit due to improper validation of user-supplied     input before returning it to users. Processing maliciously crafted web content may lead to universal cross site     scripting. (CVE-2019-8813)

  - An arbitrary code execution vulnerability exists in iOS WebKit and WebKit Processing Model. Multiple memory     corruption vulnerabilities while processing maliciously crafted web content may lead to arbitrary code execution.
   (CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8814, CVE-2019-8816, CVE-2019-8819,    CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823, CVE-2019-8815, CVE-2019-8782)

  - A logic issue in the handling of state transitions allows an attacker within Wi-Fi range to compromise     some confidentiality of network traffic. (CVE-2019-15126)

  - The HTTP referrer header leaks browsing history to maliciously crafted websites. (CVE-2019-8827)

  - A memory corruption vulnerability exists that allows applications to execute arbitrary code with kernel     privileges. (CVE-2019-8829)

The remote host is affected by the vulnerability described in GLSA-202003-22 (WebkitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebKitGTK+. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code, cause a Denial of       Service condition, bypass intended memory-read restrictions, conduct a       timing side-channel attack to bypass the Same Origin Policy or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

According to its version, the iCloud application installed on the remote Windows host is 7.x prior to 7.15. It is, therefore, affected by multiple vulnerabilities:

  - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to multiple memory     corruption issues. An unauthenticated, remote attacker can exploit this to execute arbitrary code.     (CVE-2019-8783, CVE-2019-8784, CVE-2019-8811, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819,     CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0142-1 advisory.

  - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize     a specially crafted web request to an affected SharePoint server, aka Microsoft SharePoint Elevation of     Privilege Vulnerability. This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480,     CVE-2018-8488, CVE-2018-8498. (CVE-2018-8518)

  - A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari     12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may     lead to universal cross site scripting. (CVE-2019-8551)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8558, CVE-2019-8559,     CVE-2019-8563)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13.
    Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8674)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13,     iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8681, CVE-2019-8687)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for     Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8684, CVE-2019-8688, CVE-2019-8689)

  - A logic issue existed in the handling of document loads. This issue was addressed with improved state     management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for     Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8690)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8707, CVE-2019-8726,     CVE-2019-8733)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for     Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8719)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud     for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8763)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8765)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8766)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history     items. (CVE-2019-8768)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8782)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8808)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0,     iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8815, CVE-2019-8821, CVE-2019-8822)

  - WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0)     contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue     has been fixed in 2.28.0 with improved memory handling. (CVE-2020-10018)

  - The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to     CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-     portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside     the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
    (CVE-2020-13753)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes     12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-27918)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4,     tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A     file URL may be incorrectly processed. (CVE-2020-3885)

  - A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS     13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows     7.18. An application may be able to read restricted memory. (CVE-2020-3894)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3895, CVE-2020-3900)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. (CVE-2020-3897)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3901)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for     Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.
    (CVE-2020-3902)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-9802)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and     iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows     11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2020-9803)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2020-9805)

  - A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0,     iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9947)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9948)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9951)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0     and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21.
    Processing maliciously crafted web content may lead to a cross site scripting attack. (CVE-2020-9952)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content     may violate iframe sandboxing policy. (CVE-2021-1765)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1788)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big     Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-1817)

  - A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS     Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content     may result in the disclosure of process memory. (CVE-2021-1820)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iTunes     12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS     14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting     attack. (CVE-2021-1825)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS     14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-1826)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-1844)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1871)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1,     iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously     crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-30661)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30666)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak     sensitive user information. (CVE-2021-30682)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30761)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30762)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2021-30809)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30818)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS. (CVE-2021-30823)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory. (CVE-2021-30836)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30846)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30848)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30849)

  - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30851)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and     iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code     execution. Apple is aware of a report that this issue may have been actively exploited. (CVE-2021-30858)

  - The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history. (CVE-2021-30884)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy. (CVE-2021-30887)

  - An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30889)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-30890)

  - An issue existed in the specification for the resource timing API. The specification was updated and the     updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website     may exfiltrate data cross-origin. (CVE-2021-30897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
138093	Apple iCloud 10.x < 10.8 Multiple Vulnerabilities	Nessus	Windows	2020/7/3	2022/5/12	critical
141759	Scientific Linux Security Update : webkitgtk4 on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	critical
142737	Amazon Linux 2 : webkitgtk4 (ALAS-2020-1563)	Nessus	Amazon Linux Local Security Checks	2020/11/11	2024/12/17	critical
143288	CentOS 7 : webkitgtk4 (RHSA-2020:4035)	Nessus	CentOS Local Security Checks	2020/11/30	2024/10/10	critical
130461	Apple iOS < 13.2 多个漏洞	Nessus	Mobile Devices	2019/11/1	2025/11/3	high
154614	NewStart CGSL CORE 5.05 / MAIN 5.05 : webkitgtk4 多个漏洞 (NS-SA-2021-0166)	Nessus	NewStart CGSL Local Security Checks	2021/10/28	2022/5/25	critical
134599	GLSA-202003-22：WebkitGTK+：多个漏洞	Nessus	Gentoo Local Security Checks	2020/3/16	2022/5/27	high
138080	Apple iCloud 7.x < 7.15 多个漏洞	Nessus	Windows	2020/7/2	2024/3/4	high
131533	openSUSE 安全更新：webkit2gtk3 (openSUSE-2019-2587)	Nessus	SuSE Local Security Checks	2019/12/3	2024/4/8	high
131533	openSUSE Security Update : webkit2gtk3 (openSUSE-2019-2587)	Nessus	SuSE Local Security Checks	2019/12/3	2024/4/8	high
154614	NewStart CGSL CORE 5.05 / MAIN 5.05 : webkitgtk4 Multiple Vulnerabilities (NS-SA-2021-0166)	Nessus	NewStart CGSL Local Security Checks	2021/10/28	2022/5/25	critical
130461	Apple iOS < 13.2 Multiple Vulnerabilities	Nessus	Mobile Devices	2019/11/1	2025/11/3	high
134599	GLSA-202003-22 : WebkitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/16	2022/5/27	high
138080	Apple iCloud 7.x < 7.15 Multiple Vulnerabilities	Nessus	Windows	2020/7/2	2024/3/4	high
156925	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2022:0142-1)	Nessus	SuSE Local Security Checks	2022/1/21	2025/1/24	critical

检测

插件搜索

critical

critical

critical

critical

high

critical

high

high

high

high

critical

high

high

high

critical