Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 履歴と Web サイトデータの消去で履歴が消去されませんでした。この問題は、データ削除を改善することで対処されました。この問題は、macOS Big Sur 11.1、Security Update 2020-001Catalina、Security Update 2020-007Mojave、iOS 14.3、iPadOS 14.3、tvOS 14.3で修正されています。ユーザーが閲覧履歴を削除できない可能性があります。(CVE-2020-29623)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

この webkit2gtk3 用更新プログラムでは、以下の問題を修正します :

  - バージョン 2.32.0 に更新してください（bsc#1184155）：

  - URL がポートを省略した場合の認証リクエストポートを修正します。

  - メインフレームが非同期でスクロールされる際の iframe スクロールを修正します

  - スクロールモード。

  - g_memdup の使用を停止します。

  - のシグナルハンドラーをオーバーライドする際に警告メッセージを表示します

  - スレッドの中断。

  - GCC 11 の RISC-V のビルドを修正します。

  - 複数のクラッシュおよびレンダリングの問題を修正します。

  - セキュリティ修正：CVE-2021-1788、CVE-2021-1844、CVE-2021-1871

  - バージョン 2.30.6 の更新 (bsc#1184262) :

  - Google ドキュメントと Google ドライブのユーザーエージェントの不具合を再度更新します。

  - 複数のクラッシュおよびレンダリングの問題を修正します。

  - セキュリティ修正：CVE-2020-27918、CVE-2020-29623、CVE-2021-1765 CVE-2021-1789、CVE-2021-1799、CVE-2021-1801、CVE-2021-1870。

  - armv6/armv7 の _constraints を更新します (bsc#1182719)

  - 2.32.0 で削除された NPAPI プラグインサポートを復元します 

この更新はSUSEからインポートされました：SLE-15-SP2: 更新プロジェクトを更新します。

リモートの SUSE Linux SUSE15ホストには、openSUSE-SU-2022:0182-1のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - 複数のメモリ破損の問題が、メモリ処理を改善することで対処されました。この問題は、watchOS 6.1、Windows 11.0用のiCloudで修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2019-8766)

  - 複数のメモリ破損の問題が、メモリ処理を改善することで対処されました。この問題は、iOS 13.2およびiPasOS 13.2、tvOS 13.2、Safari 13.0.3、Windows 12.10.2 用の iTunes、Windows 11.0 用の iCloud で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2019-8782)

  - 複数のメモリ破損の問題が、メモリ処理を改善することで対処されました。この問題は、iOS 13.2およびiPasOS 13.2、tvOS 13.2、watchOS 6.1、Safari 13.0.3、Windows 12.10.2用のiTunes で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2019-8808)

  - 複数のメモリ破損の問題が、メモリ処理を改善することで対処されました。この問題は、iOS 13.2および iPadOS 13.2、tvOS 13.2、Safari 13.0.3、Windows 12.10.2 用の iTunes、Windows 11.0 用の iCloud、Windows 7.15 用の iCloud で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。
    (CVE-2019-8815)

  2.28.3より前の WebKitGTK および WPE WebKit のバブルラップサンドボックスでは、CLONE_NEWUSER および TIOCSTI ioctl へのアクセスが正しくブロックされませんでした。CLONE_NEWUSER が xdg-desktop-portal を混乱させるために使用される可能性があり、その場合、サンドボックス外へのアクセスが可能になります。コントロールターミナルにあるCVE-2017-5226と同様の入力バッファに書き込むことで、TIOCSTI を使用してサンドボックス外でコマンドが直接実行される可能性があります。
    (CVE-2020-13753)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は、macOS Big Sur 11.0.1、watchOS 7.1、iOS 14.2、iPadOS 14.2、Windows 11.5 用の iCloud、Safari 14.0.1、tvOS 14.2、Windows 用の iTunes 12.11で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。
    (CVE-2020-27918)

  - 履歴と Web サイトデータの消去で履歴が消去されませんでした。この問題は、データ削除を改善することで対処されました。この問題は、macOS Big Sur 11.1、Security Update 2020-001Catalina、Security Update 2020-007Mojave、iOS 14.3、iPadOS 14.3、tvOS 14.3で修正されています。ユーザーが閲覧履歴を削除できない可能性があります。(CVE-2020-29623)

  - 入力検証を改善することで、入力検証の問題に対処しました。この問題は、iOS 13.4および iPadOS 13.4、tvOS 13.4、Safari 13.1、Windows 12.10.5 用の iTunes、Windows 10.9.3 用の iCloud、Windows 7.18 用の iCloud で修正されています。悪意のある細工された  Web コンテンツを処理することで、クロスサイトスクリプティングが引き起こされる可能性があります。
    (CVE-2020-3902)

  - 制限が改善され、ロジックの問題が対処されました。この問題は、iOS 13.5およびiPadOS 13.5、tvOS 13.4.5、watchOS 6.2.5、Safari 13.1.1、Windows 12.10.7用のiTunes、Windows 11.2用のiCloud、Windows 7.19用のiCloudで修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。
    (CVE-2020-9802)

  - 検証を改善することで、メモリ破損の問題に対処しました。この問題は、iOS 13.5およびiPadOS 13.5、tvOS 13.4.5、watchOS 6.2.5、Safari 13.1.1、Windows 12.10.7用のiTunes、Windows 11.2用のiCloud、Windows 7.19用のiCloudで修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2020-9803)

  - 制限が改善され、ロジックの問題が対処されました。この問題は、iOS 13.5およびiPadOS 13.5、tvOS 13.4.5、watchOS 6.2.5、Safari 13.1.1、Windows 12.10.7用のiTunes、Windows 11.2用のiCloud、Windows 7.19用のiCloudで修正されています。悪意のある細工された  Web コンテンツを処理することで、ユニバーサルクロスサイトスクリプティングが引き起こされる可能性があります。
    (CVE-2020-9805)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は、watchOS 7.0、iOS 14.0および iPadOS 14.0、Windows 12.10.9用の iTunes、Windows 11.5用の iCloud、tvOS 14.0、Safari 14.0で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2020-9947)

  - 型の取り違えの問題が、メモリ処理を改善することで対処されました。この問題は、Safari 14.0で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2020-9948)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は、Safari 14.0で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2020-9951)

  - 入力検証を改善することで、入力検証の問題に対処しました。この問題は、iOS 14.0およびiPadOS 14.0、tvOS 14.0、watchOS 7.0、Safari 14.0、Windows 11.4用のiCloud、Windows 7.21用のiCloudで修正されています。
    悪意を持って細工された Web コンテンツを処理することで、クロスサイトスクリプティングが引き起こされる可能性があります。(CVE-2020-9952)

  - この問題は、iframeサンドボックスの実施を改善することで対処されました。この問題は、macOS Big Sur 11.2、Security Update 2021-001Catalina、Security Update 2021-001Mojaveで修正されています。悪意を持って作成された Web コンテンツは、iframe サンドボックスポリシーに違反する可能性があります。(CVE-2021-1765)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は、macOS Big Sur 11.2、Security Update 2021-001Catalina、Security Update 2021-001Mojave、tvOS 14.4、watchOS 7.3、iOS 14.4およびiPadOS 14.4、Safari 14.0.3で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-1788)

  - 状態管理を改善することで、メモリ破損の問題に対処しました。この問題は macOS Big Sur 11.3、iOS 14.5および iPadOS 14.5、watchOS 7.4、tvOS 14.5で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-1817)

  - メモリ初期化の問題が、メモリ処理を改善することで対処されました。この問題は macOS Big Sur 11.3、iOS 14.5および iPadOS 14.5、watchOS 7.4、tvOS 14.5で修正されています。悪意を持って細工された Web コンテンツを処理すると、プロセスメモリが漏洩する可能性があります。(CVE-2021-1820)

  - 入力検証を改善することで、入力検証の問題に対処しました。この問題は iTunes 12.11.3for Windows、iCloud for Windows 12.3、macOS Big Sur 11.3、Safari 14.1、watchOS 7.4、tvOS 14.5、iOS 14.5および iPadOS 14.5で修正されています。悪意を持って細工された Web コンテンツを処理することで、クロスサイトスクリプティングが引き起こされる可能性があります。(CVE-2021-1825)

  - 制限が改善され、ロジックの問題が対処されました。この問題は macOS Big Sur 11.3、iOS 14.5および iPadOS 14.5、watchOS 7.4、tvOS 14.5で修正されています。悪意を持って細工された Web コンテンツを処理することで、ユニバーサルクロスサイトスクリプティングが引き起こされる可能性があります。(CVE-2021-1826)

  - 検証を改善することで、メモリ破損の問題に対処しました。この問題は、iOS 14.4.1、iPadOS 14.4.1、Safari 14.0.3(v. 14610.4.3.1.7および15610.4.3.1.7)、watchOS 7.3.2、macOS Big Sur 11.2.3で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-1844)

  - 制限が改善され、ロジックの問題が対処されました。この問題は、macOS Big Sur 11.2、Security Update 2021-001Catalina、Security Update 2021-001Mojave、iOS 14.4およびiPadOS 14.4で修正されています。リモートの攻撃者が、任意のコードを実行する可能性があります。Apple は、この問題が積極的に悪用された可能性があるという報告を認識しています。(CVE-2021-1871)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は Safari 14.1、iOS 12.5.3、iOS 14.5および iPadOS 14.5、watchOS 7.4、tvOS 14.5、macOS Big Sur 11.3で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。Apple は、この問題が積極的に悪用された可能性があるという報告を認識しています。(CVE-2021-30661)

  - バッファオーバーフローの問題が、メモリ処理を改善することで対処されました。この問題は、iOS 12.5.3で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。Apple は、この問題が積極的に悪用された可能性があるという報告を認識しています。(CVE-2021-30666)

  - 制限が改善され、ロジックの問題が対処されました。この問題は、tvOS 14.6、iOS 14.6、iPadOS 14.6、Safari 14.1.1、macOS Big Sur 11.4、watchOS 7.5で修正されています。悪意のあるアプリケーションが、ユーザーの機密情報を漏洩する可能性があります。(CVE-2021-30682)

  - 状態管理を改善することで、メモリ破損の問題に対処しました。この問題は、iOS 12.5.4で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。Apple は、この問題が積極的に悪用された可能性があるという報告を認識しています。(CVE-2021-30761)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は、iOS 12.5.4で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。Apple は、この問題が積極的に悪用された可能性があるという報告を認識しています。(CVE-2021-30762)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は、Safari 15、tvOS 15、watchOS 8、iOS 15 および iPadOS 15 で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-30809)

  - 型の取り違えの問題が、状態処理を改善することで対処されました。この問題は iOS 14.8および iPadOS 14.8、tvOS 15、iOS 15 および iPadOS 15、Safari 15、watchOS 8 で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-30818)

  - 制限が改善され、ロジックの問題が対処されました。この問題は macOS Montrey 12.0.1、iOS 14.8および iPadOS 14.8、tvOS 15、Safari 15、watchOS 8 で修正されています。権限のあるネットワークポジションの攻撃者が、HSTS をバイパスできる可能性があります。(CVE-2021-30823)

  - 領域外読み取りは、入力検証の改善により対応されました。この問題は iOS 14.8および iPadOS 14.8、tvOS 15、watchOS 8、iOS 15 および iPadOS 15 で修正されています。悪意を持って細工されたオーディオファイルを処理すると、制限されたメモリが漏洩する可能性があります。(CVE-2021-30836)

  - メモリ破損の問題が、メモリ処理を改善することで対処されました。この問題は、iOS 14.8および iPadOS 14.8、Safari 15、tvOS 15、iOS 15 および iPadOS 15、watchOS 8 で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-30846)

  - メモリ破損の問題が、メモリ処理を改善することで対処されました。この問題は iOS 14.8および iPadOS 14.8、Safari 15、iOS 15 および iPadOS 15 で修正されています。悪意を持って細工された Web コンテンツを処理すると、コードが実行される可能性があります。(CVE-2021-30848)

  - 複数のメモリ破損の問題が、メモリ処理を改善することで対処されました。この問題は iOS 14.8および iPadOS 14.8、watchOS 8、Safari 15、tvOS 15、iOS 15 および iPadOS 15、iTunes 12.12for Windows で修正されています。
    悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-30849)

  - メモリ破損の脆弱性は、ロッキングを改善することで対処されました。この問題は、Safari 15、tvOS 15、watchOS 8、iOS 15 および iPadOS 15 で修正されています。悪意を持って細工された Web コンテンツを処理すると、コードが実行される可能性があります。(CVE-2021-30851)

  - メモリ管理を改善することで、メモリ解放後使用 (Use After Free) の問題に対処しました。この問題は、iOS 14.8、iPadOS 14.8、macOS Big Sur 11.6で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。Apple は、この問題が積極的に悪用された可能性があるという報告を認識しています。(CVE-2021-30858)

  - この問題は、CSS 合成の追加制限により解決されました。この問題は tvOS 15、watchOS 8、iOS 15 および iPadOS 15 で修正されています。悪意を持って細工された Web サイトにアクセスすると、ユーザーの閲覧履歴が漏洩する可能性があります。(CVE-2021-30884)

  - 制限が改善され、ロジックの問題が対処されました。この問題は、macOS Monterey 12.0.1、iOS 15.1および iPadOS 15.1、watchOS 8.1、tvOS 15.1で修正されています。悪意を持って細工された Web コンテンツを処理することで、コンテンツセキュリティポリシーが予期せずに強制されないという可能性があります。(CVE-2021-30887 )

  - 情報漏洩の問題が解決されました。この問題は iOS 15.1および iPadOS 15.1、macOS Monterey 12.0.1、iOS 14.8.1および iPadOS 14.8.1、tvOS 15.1、watchOS 8.1で修正されています。コンテンツセキュリティポリシーレポートを使用する悪意のある Web サイトが、リダイレクト動作を介して情報を漏洩する可能性があります。(CVE-2021-30888)

  - バッファオーバーフローの問題が、メモリ処理を改善することで対処されました。この問題は、macOS Monterey 12.0.1、iOS 15.1および iPadOS 15.1、watchOS 8.1、tvOS 15.1で修正されています。悪意を持って細工された Web コンテンツを処理すると、任意のコードが実行される可能性があります。(CVE-2021-30889)

  - 状態管理を改善することで、ロジックの問題に対処しました。この問題は、macOS Monterey 12.0.1、iOS 15.1および iPadOS 15.1、watchOS 8.1、tvOS 15.1で修正されています。悪意を持って細工された Web コンテンツを処理することで、ユニバーサルクロスサイトスクリプティングが引き起こされる可能性があります。(CVE-2021-30890)

  - リソースタイミング API の仕様に問題が存在しました。仕様が更新され、更新された仕様が実装されました。この問題は macOS Monterey 12.0.1で修正されています。悪意のある Web サイトでデータが、クロスオリジンで抽出される可能性があります。(CVE-2021-30897)

Nessus はこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for webkit2gtk3 fixes the following issues :

  - Update to version 2.32.0 (bsc#1184155) :

  - Fix the authentication request port when URL omits the     port.

  - Fix iframe scrolling when main frame is scrolled in     async

  - scrolling mode.

  - Stop using g_memdup.

  - Show a warning message when overriding signal handler     for

  - threading suspension.

  - Fix the build on RISC-V with GCC 11.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2021-1788, CVE-2021-1844,     CVE-2021-1871

  - Update in version 2.30.6 (bsc#1184262) :

  - Update user agent quirks again for Google Docs and     Google Drive.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2020-27918, CVE-2020-29623,     CVE-2021-1765 CVE-2021-1789, CVE-2021-1799,     CVE-2021-1801, CVE-2021-1870.

  - Update _constraints for armv6/armv7 (bsc#1182719)

  - restore NPAPI plugin support which was removed in 2.32.0

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-202104-03 (WebkitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebkitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker, by enticing a user to visit maliciously crafted web       content, may be able to execute arbitrary code, violate iframe sandboxing       policy, access restricted ports on arbitrary servers, cause memory       corruption, or could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities:

  - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in     versions prior to 2.30.5. Processing maliciously crafted web content may lead to arbitrary code execution.
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-13558)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27918)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully     delete the browsing history under some circumstances. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-29623)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content     may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
    (CVE-2021-1765, CVE-2021-1801)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-1788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0142-1 advisory.

  - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize     a specially crafted web request to an affected SharePoint server, aka Microsoft SharePoint Elevation of     Privilege Vulnerability. This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480,     CVE-2018-8488, CVE-2018-8498. (CVE-2018-8518)

  - A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari     12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may     lead to universal cross site scripting. (CVE-2019-8551)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8558, CVE-2019-8559,     CVE-2019-8563)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13.
    Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8674)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13,     iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8681, CVE-2019-8687)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for     Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8684, CVE-2019-8688, CVE-2019-8689)

  - A logic issue existed in the handling of document loads. This issue was addressed with improved state     management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for     Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8690)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8707, CVE-2019-8726,     CVE-2019-8733)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for     Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8719)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud     for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8763)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8765)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8766)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history     items. (CVE-2019-8768)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8782)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8808)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0,     iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8815, CVE-2019-8821, CVE-2019-8822)

  - WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0)     contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue     has been fixed in 2.28.0 with improved memory handling. (CVE-2020-10018)

  - The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to     CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-     portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside     the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
    (CVE-2020-13753)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes     12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-27918)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4,     tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A     file URL may be incorrectly processed. (CVE-2020-3885)

  - A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS     13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows     7.18. An application may be able to read restricted memory. (CVE-2020-3894)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3895, CVE-2020-3900)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. (CVE-2020-3897)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3901)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for     Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.
    (CVE-2020-3902)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-9802)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and     iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows     11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2020-9803)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2020-9805)

  - A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0,     iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9947)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9948)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9951)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0     and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21.
    Processing maliciously crafted web content may lead to a cross site scripting attack. (CVE-2020-9952)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content     may violate iframe sandboxing policy. (CVE-2021-1765)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1788)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big     Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-1817)

  - A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS     Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content     may result in the disclosure of process memory. (CVE-2021-1820)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iTunes     12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS     14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting     attack. (CVE-2021-1825)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS     14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-1826)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-1844)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1871)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1,     iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously     crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-30661)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30666)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak     sensitive user information. (CVE-2021-30682)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30761)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30762)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2021-30809)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30818)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS. (CVE-2021-30823)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory. (CVE-2021-30836)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30846)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30848)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30849)

  - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30851)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and     iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code     execution. Apple is aware of a report that this issue may have been actively exploited. (CVE-2021-30858)

  - The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history. (CVE-2021-30884)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy. (CVE-2021-30887)

  - An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30889)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-30890)

  - An issue existed in the specification for the resource timing API. The specification was updated and the     updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website     may exfiltrate data cross-origin. (CVE-2021-30897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0182-1 advisory.

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8766)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8782)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8808)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0,     iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8815)

  - The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to     CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-     portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside     the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
    (CVE-2020-13753)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes     12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-27918)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for     Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.
    (CVE-2020-3902)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-9802)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and     iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows     11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2020-9803)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2020-9805)

  - A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0,     iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9947)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9948)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9951)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0     and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21.
    Processing maliciously crafted web content may lead to a cross site scripting attack. (CVE-2020-9952)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content     may violate iframe sandboxing policy. (CVE-2021-1765)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1788)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big     Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-1817)

  - A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS     Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content     may result in the disclosure of process memory. (CVE-2021-1820)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iTunes     12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS     14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting     attack. (CVE-2021-1825)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS     14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-1826)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-1844)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1871)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1,     iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously     crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-30661)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30666)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak     sensitive user information. (CVE-2021-30682)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30761)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30762)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2021-30809)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30818)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS. (CVE-2021-30823)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory. (CVE-2021-30836)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30846)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30848)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30849)

  - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30851)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and     iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code     execution. Apple is aware of a report that this issue may have been actively exploited. (CVE-2021-30858)

  - The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history. (CVE-2021-30884)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy. (CVE-2021-30887)

  - An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30889)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-30890)

  - An issue existed in the specification for the resource timing API. The specification was updated and the     updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website     may exfiltrate data cross-origin. (CVE-2021-30897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0183-1 advisory.

  - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize     a specially crafted web request to an affected SharePoint server, aka Microsoft SharePoint Elevation of     Privilege Vulnerability. This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8480,     CVE-2018-8488, CVE-2018-8498. (CVE-2018-8518)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8766)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history     items. (CVE-2019-8768)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8782)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8808)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0,     iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8815)

  - WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0)     contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue     has been fixed in 2.28.0 with improved memory handling. (CVE-2020-10018)

  - The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to     CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-     portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside     the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.
    (CVE-2020-13753)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes     12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-27918)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4,     tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A     file URL may be incorrectly processed. (CVE-2020-3885)

  - A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS     13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows     7.18. An application may be able to read restricted memory. (CVE-2020-3894)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3895, CVE-2020-3900)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. (CVE-2020-3897)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3901)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for     Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.
    (CVE-2020-3902)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-9802)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 13.5 and     iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows     11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2020-9803)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5,     tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for     Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2020-9805)

  - A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0,     iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9947)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9948)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9951)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0     and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21.
    Processing maliciously crafted web content may lead to a cross site scripting attack. (CVE-2020-9952)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content     may violate iframe sandboxing policy. (CVE-2021-1765)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1788)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big     Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-1817)

  - A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS     Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content     may result in the disclosure of process memory. (CVE-2021-1820)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iTunes     12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS     14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting     attack. (CVE-2021-1825)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.3, iOS     14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-1826)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-1844)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1871)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1,     iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously     crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-30661)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30666)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak     sensitive user information. (CVE-2021-30682)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30761)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30762)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2021-30809)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30818)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS. (CVE-2021-30823)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory. (CVE-2021-30836)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30846)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30848)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30849)

  - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution. (CVE-2021-30851)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and     iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code     execution. Apple is aware of a report that this issue may have been actively exploited. (CVE-2021-30858)

  - The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history. (CVE-2021-30884)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy. (CVE-2021-30887)

  - An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30889)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-30890)

  - An issue existed in the specification for the resource timing API. The specification was updated and the     updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website     may exfiltrate data cross-origin. (CVE-2021-30897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
257895	Linux Distros のパッチ未適用の脆弱性: CVE-2020-29623	Nessus	Misc.	2025/8/27	2025/8/27	low
149570	openSUSEセキュリティ更新プログラム：webkit2gtk3 (openSUSE-2021-637)	Nessus	SuSE Local Security Checks	2021/5/18	2023/4/25	critical
156925	SUSE SLED12 / SLES12 セキュリティ更新プログラム: webkit2gtk3 (SUSE-SU-2022:0142-1)	Nessus	SuSE Local Security Checks	2022/1/21	2025/1/24	critical
157093	openSUSE 15 セキュリティ更新: webkit2gtk3 (openSUSE-SU-2022:0182-1)	Nessus	SuSE Local Security Checks	2022/1/26	2025/1/24	critical
157109	SUSE SLES15 セキュリティ更新プログラム: webkit2gtk3 (SUSE-SU-2022:0183-1)	Nessus	SuSE Local Security Checks	2022/1/26	2025/1/24	critical
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/10/21	critical
257895	Linux Distros Unpatched Vulnerability : CVE-2020-29623	Nessus	Misc.	2025/8/27	2025/8/27	low
149570	openSUSE Security Update : webkit2gtk3 (openSUSE-2021-637)	Nessus	SuSE Local Security Checks	2021/5/18	2023/4/25	critical
149222	GLSA-202104-03 : WebkitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2021/5/3	2022/5/6	critical
206839	NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
156925	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2022:0142-1)	Nessus	SuSE Local Security Checks	2022/1/21	2025/1/24	critical
157093	openSUSE 15 Security Update : webkit2gtk3 (openSUSE-SU-2022:0182-1)	Nessus	SuSE Local Security Checks	2022/1/26	2025/1/24	critical
157109	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2022:0183-1)	Nessus	SuSE Local Security Checks	2022/1/26	2025/1/24	critical
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/10/21	critical

检测

插件搜索

low

critical

critical

critical

critical

critical

low

critical

critical

critical

critical

critical

critical

critical