モバイルデバイスで実行中の Apple iOS のバージョンは、14.7 より前です。したがって、複数の脆弱性の影響を受けます。

リモートRedhat Enterprise Linux 8ホストに、RHSA-2021:4381アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - webkitgtk: 任意のコード実行を引き起こす AudioSourceProviderGStreamer のメモリ解放後使用 (Use After Free) (CVE-2020-13558)

  - LibRaw: identify.cpp の LibRaw::identify_process_dng_fields() のスタックバッファオーバーフロー (CVE-2020-24870)

  - webkitgtk: 任意のコード実行を引き起こすメモリ解放後使用 (Use After Free) (CVE-2020-27918、CVE-2021-1788、CVE-2021-30795)

  - webkitgtk: ユーザーが閲覧履歴を削除できない可能性があります (CVE-2020-29623)

  - gnome-autoar: 宛先ディレクトリの外部を指し示すディレクトリシンボリックリンクによるディレクトリトラバーサル (CVE-2020-36241)

  - webkitgtk: IFrame サンドボックスポリシーの違反 (CVE-2021-1765、CVE-2021-1801)

  - webkitgtk: 型の取り違え問題により任意コード実行を引き起こす可能性があります (CVE-2021-1789)

  - webkitgtk: ポートのリダイレクトによる任意サーバーの制限されたポートへのアクセス (CVE-2021-1799)

  - webkitgtk: メモリ破損問題により、任意のコードが実行される可能性があります (CVE-2021-1844)

  - webkitgtk: 任意コード実行に至るロジック問題 (CVE-2021-1870、CVE-2021-1871)

  - webkitgtk: 情報漏洩および場合によってはコード実行に至る ImageLoader dispatchPendingErrorEvent におけるメモリ解放後使用 (Use After Free) (CVE-2021-21775)

  - webkitgtk: 情報漏洩および場合によってはコード実行に至る WebCore::GraphicsContext のメモリ解放後使用 (Use After Free) (CVE-2021-21779)

  - webkitgtk: 任意コード実行に至る fireEventListeners におけるメモリ解放後使用 (Use After Free) (CVE-2021-21806)

  - gnome-autoar: 宛先ディレクトリの外部を指し示すディレクトリシンボリックリンクによるディレクトリトラバーサル (不完全な CVE-2020-36241 修正) (CVE-2021-28650)

  - webkitgtk: 任意のコード実行を引き起こす整数オーバーフロー (CVE-2021-30663)

  - webkitgtk: 任意のコード実行を引き起こすメモリ破損 (CVE-2021-30665)

  - webkitgtk: 機密のユーザー情報の漏洩を引き起こすロジックの問題 (CVE-2021-30682)

  - webkitgtk: ユニバーサルクロスサイトスクリプト攻撃につながるロジックの問題 (CVE-2021-30689)

  - webkitgtk: 任意サーバーの制限されたポートへのアクセスを許可するロジックの問題 (CVE-2021-30720)

  - webkitgtk: 任意のコード実行を引き起こすメモリ破損 (CVE-2021-30734、CVE-2021-30749、CVE-2021-30799)

  - webkitgtk: ユニバーサルクロスサイトスクリプト攻撃につながる iframe 要素があるクロスオリジン問題 (CVE-2021-30744)

  - webkitgtk: 型の取り違え問題により任意コード実行を引き起こす可能性があります (CVE-2021-30758)

  - webkitgtk: 任意のコード実行を引き起こす不十分なチェック (CVE-2021-30797)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - チェックを改善することで、この問題に対処しました。この問題は、iOS 14.7、Safari 14.1.2、macOS Big Sur 11.5、watchOS 7.6、tvOS 14.7 で修正されています。悪意を持って細工されたウェブコンテンツを処理すると、コードが実行される可能性があります。
    (CVE-2021-30797)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

远程 Ubuntu 18.04 LTS / 20.04 LTS / 21.04 主机上安装的程序包受到 USN-5024-1 公告中提及的多个漏洞的影响。

  - 在 Webkit WebKitGTK 2.30.4 中，为 ImageLoader 对象处理某些事件的方式中存在释放后使用漏洞。攻击者利用特别构建的网页，可能造成信息泄漏，并进一步损坏内存。攻击者必须诱骗受害者访问恶意网页，才能触发该漏洞。(CVE-2021-21775)

  - 在 WebKitGTK 2.30.4 中，Webkits GraphicsContext 处理某些事件的方式中存在释放后使用漏洞。攻击者利用特别构建的网页，可能造成信息泄漏，并进一步损坏内存。攻击者必须诱骗受害者访问恶意网页，才能触发该漏洞。
    (CVE-2021-21779)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Debian 10 主机上安装的多个程序包受到 dsa-4945 公告中提及的多个漏洞影响。

  - 在 Webkit WebKitGTK 2.30.4 中，为 ImageLoader 对象处理某些事件的方式中存在释放后使用漏洞。攻击者利用特别构建的网页，可能造成信息泄漏，并进一步损坏内存。攻击者必须诱骗受害者访问恶意网页，才能触发该漏洞。(CVE-2021-21775)

  - 在 WebKitGTK 2.30.4 中，Webkits GraphicsContext 处理某些事件的方式中存在释放后使用漏洞。攻击者利用特别构建的网页，可能造成信息泄漏，并进一步损坏内存。攻击者必须诱骗受害者访问恶意网页，才能触发该漏洞。
    (CVE-2021-21779)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

移动设备上运行的 Apple iOS 版本低于 14.7。因此，该主机受到多个漏洞的影响。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2021:4381 公告中提及的多个漏洞的影响。

  - webkitgtk：AudioSourceProviderGStreamer 中存在释放后使用问题，可导致任意代码执行 (CVE-2020-13558)

  - LibRaw：identify.cpp 的 LibRaw::identify_process_dng_fields() 中存在堆栈缓冲区溢出问题 (CVE-2020-24870)

  - webkitgtk：释放后使用可导致任意代码执行（CVE-2020-27918、CVE-2021-1788、CVE-2021-30795）

  - webkitgtk：用户可能无法完全删除浏览历史记录 (CVE-2020-29623)

  - gnome-autoar：通过指向目标目录外的目录符号链接可导致目录遍历 (CVE-2020-36241)

  - webkitgtk：违反 IFrame 沙盒策略（CVE-2021-1765、CVE-2021-1801）

  - webkitgtk：类型混淆问题可导致任意代码执行 (CVE-2021-1789)

  - webkitgtk：通过端口重定向访问任意服务器上的受限端口 (CVE-2021-1799)

  - webkitgtk：内存损坏问题可导致任意代码执行 (CVE-2021-1844)

  - webkitgtk：逻辑问题可导致任意代码执行（CVE-2021-1870、CVE-2021-1871）

  - webkitgtk：ImageLoader dispatchPendingErrorEvent 中存在释放后使用问题，可导致信息泄漏并可能导致代码执行 (CVE-2021-21775)

  - webkitgtk：WebCore::GraphicsContext 中存在释放后使用问题，可导致信息泄漏并可能导致代码执行 (CVE-2021-21779)

  - webkitgtk：fireEventListeners 中存在释放后使用问题，可导致任意代码执行 (CVE-2021-21806)

  - gnome-autoar：通过指向目标目录外的目录符号链接可导致目录遍历（不完整的 CVE-2020-36241 修正）(CVE-2021-28650)

  - webkitgtk：整数溢出可导致任意代码执行 (CVE-2021-30663)

  - webkitgtk：内存损坏可导致任意代码执行 (CVE-2021-30665)

  - webkitgtk：逻辑问题可导致敏感用户信息泄露 (CVE-2021-30682)

  - webkitgtk：逻辑问题可导致通用跨站脚本攻击 (CVE-2021-30689)

  - webkitgtk：存在逻辑问题，攻击者可访问任意服务器上受限制的端口 (CVE-2021-30720)

  - webkitgtk：内存损坏可导致任意代码执行（CVE-2021-30734、CVE-2021-30749、CVE-2021-30799）

  - webkitgtk：iframe 元素存在跨源问题，可导致通用跨站脚本攻击 (CVE-2021-30744)

  - webkitgtk：类型混淆可导致任意代码执行 (CVE-2021-30758)

  - webkitgtk：检查不充分可导致任意代码执行 (CVE-2021-30797)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 已通过改进检查解决此问题。此问题已在 iOS 14.7、Safari 14.1.2、macOS Big Sur 11.5、watchOS 7.6、tvOS 14.7 中修复。处理恶意构建的 Web 内容可能会导致代码执行。
    (CVE-2021-30797)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2598-1 advisory.

  - A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of     Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further     memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a     malicious webpage. (CVE-2021-21775)

  - A use-after-free vulnerability exists in the way Webkit's GraphicsContext handles certain events in     WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory     corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.
    (CVE-2021-21779)

  - An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and     iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2021-30663)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS     7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously     crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-30665)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content     may lead to universal cross site scripting. (CVE-2021-30689)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access     restricted ports on arbitrary servers. (CVE-2021-30720)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30734, CVE-2021-30749)

  - Description: A cross-origin issue with iframe elements was addressed with improved tracking of security     origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4,     watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2021-30744)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari     14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to     arbitrary code execution. (CVE-2021-30758)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7,     Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30795)

  - This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big     Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code execution.
    (CVE-2021-30797)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.7, macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30799)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2762-1 advisory.

  - A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of     Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further     memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a     malicious webpage. (CVE-2021-21775)

  - A use-after-free vulnerability exists in the way Webkit's GraphicsContext handles certain events in     WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory     corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.
    (CVE-2021-21779)

  - An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and     iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2021-30663)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS     7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously     crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-30665)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content     may lead to universal cross site scripting. (CVE-2021-30689)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access     restricted ports on arbitrary servers. (CVE-2021-30720)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30734, CVE-2021-30749)

  - Description: A cross-origin issue with iframe elements was addressed with improved tracking of security     origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4,     watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2021-30744)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari     14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to     arbitrary code execution. (CVE-2021-30758)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7,     Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30795)

  - This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big     Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code execution.
    (CVE-2021-30797)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.7, macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30799)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities:

  - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in     versions prior to 2.30.5. Processing maliciously crafted web content may lead to arbitrary code execution.
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-13558)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27918)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully     delete the browsing history under some circumstances. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-29623)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content     may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
    (CVE-2021-1765, CVE-2021-1801)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-1788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
152037	Apple iOS < 14.7 複数の脆弱性 (HT212601)	Nessus	Mobile Devices	2021/7/23	2025/7/14	critical
155153	RHEL 8：GNOME（RHSA-2021:4381）	Nessus	Red Hat Local Security Checks	2021/11/11	2024/11/7	critical
257596	Linux Distros のパッチ未適用の脆弱性: CVE-2021-30797	Nessus	Misc.	2025/8/27	2025/8/27	high
152135	Ubuntu 18.04 LTS / 20.04 LTS：WebKitGTK 漏洞 (USN-5024-1)	Nessus	Ubuntu Local Security Checks	2021/7/28	2024/8/27	high
152138	Debian DSA-4945-1：webkit2gtk - 安全更新	Nessus	Debian Local Security Checks	2021/7/29	2023/4/25	high
152037	Apple iOS < 14.7 多个漏洞 (HT212601)	Nessus	Mobile Devices	2021/7/23	2025/7/14	critical
155153	RHEL 8 : GNOME (RHSA-2021:4381)	Nessus	Red Hat Local Security Checks	2021/11/11	2024/11/7	critical
257596	Linux Distros 未修补的漏洞：CVE-2021-30797	Nessus	Misc.	2025/8/27	2025/8/27	high
152202	SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2021:2598-1)	Nessus	SuSE Local Security Checks	2021/8/4	2023/7/13	high
152656	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2021:2762-1)	Nessus	SuSE Local Security Checks	2021/8/18	2023/7/13	high
206839	NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/7/7	critical

检测

插件搜索

critical

critical

high

high

high

critical

critical

high

high

high

critical

critical