The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities:

  - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in     versions prior to 2.30.5. Processing maliciously crafted web content may lead to arbitrary code execution.
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-13558)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27918)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully     delete the browsing history under some circumstances. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-29623)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content     may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
    (CVE-2021-1765, CVE-2021-1801)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-1788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0162 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-1844:
    A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution.

    CVE-2021-30809:
    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution.

    CVE-2021-30818:
    A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution.

    CVE-2021-30823:
    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS.

    CVE-2021-30836:
    An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory.

    CVE-2021-30846:
    A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution.

    CVE-2021-30848:
    A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution.

    CVE-2021-30849:
    Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows.
    Processing maliciously crafted web content may lead to arbitrary code execution.

    CVE-2021-30851:
    A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code     execution.

    CVE-2021-30884:
    The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history.

    CVE-2021-30887:
    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy.

    CVE-2021-30888:
    An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior .

    CVE-2021-30889:
    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution.

    CVE-2021-30890:
    A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting.

    CVE-2021-30897:
    An issue existed in the specification for the resource timing API. The specification was updated and the     updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website     may exfiltrate data cross-origin.

    CVE-2021-30934:
    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2,     macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted     web content may lead to arbitrary code execution.

    CVE-2021-30936:
    A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2,     macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted     web content may lead to arbitrary code execution.

    CVE-2021-30951:
    A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2,     macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted     web content may lead to arbitrary code execution.

    CVE-2021-30952:
    An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS     Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web     content may lead to arbitrary code execution.

    CVE-2021-30953:
    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2, macOS     Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web     content may lead to arbitrary code execution.

    CVE-2021-30954:
    A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2,     macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted     web content may lead to arbitrary code execution.

    CVE-2021-30984:
    A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2, macOS     Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web     content may lead to arbitrary code execution.

    CVE-2021-45481:
    In WebKitGTK before 2.32.4, there is incorrect memory allocation in     WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application     crash, a different vulnerability than CVE-2021-30889.

    CVE-2021-45482:
    In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different     vulnerability than CVE-2021-30889.

    CVE-2021-45483:
    In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability     than CVE-2021-30889.

    CVE-2022-22589:
    A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and     iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted     mail message may lead to running arbitrary javascript.

    CVE-2022-22590:
    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.3 and     iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web     content may lead to arbitrary code execution.

    VE-2022-22637     A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS     15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content     may prevent Content Security Policy from being enforced.

    CVE-2022-22594:
    A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed     in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be     able to track sensitive user information.

    CVE-2022-22620:
    A use after free issue was addressed with improved memory management. This issue is fixed in macOS     Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8).
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited..

    CVE-2022-22637:
    No description is available for this CVE.

    CVE-2022-22662:
    A cookie management issue was addressed with improved state management. This issue is fixed in Security     Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose     sensitive user information.

    CVE-2022-32893:
    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS     15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content     may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively     exploited.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0142-1 advisory.

    - Update to version 2.34.3 (bsc#1194019).
    - CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when     processing maliciously crafted web content.
    - CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously     crafted web content.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue existed in the specification for the resource timing API. The specification was updated and the     updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website     may exfiltrate data cross-origin. (CVE-2021-30897)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3625:01 advisory.

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)
      * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)
      * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)
      * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)
      * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)
      * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)
      * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)
      * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)
      * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)
      * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)
      * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)
      * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)
      * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)
      * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)
      * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)
      * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)
      * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)
      * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1777 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.34.6). (BZ#1985042)

    Security Fix(es):

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)

    * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)

    * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)

    * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)

    * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)

    * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)

    * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)

    * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)

    * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)

    * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)

    * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)

    * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)

    * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)

    * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)

    * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)

    * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)

    * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1777 advisory.

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2021-30809)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30818)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS. (CVE-2021-30823)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory. (CVE-2021-30836)

  - The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history. (CVE-2021-30884)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy. (CVE-2021-30887)

  - An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30889)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-30890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0182-1 advisory.

    - Update to version 2.34.3 (bsc#1194019).
    - CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy when     processing maliciously crafted web content.
    - CVE-2021-30890: Fixed logic issue allowing universal cross site scripting when processing maliciously     crafted web content.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
206839	NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2026/3/7	critical
236537	Alibaba Cloud Linux 3 : 0162: webkit2gtk3 (ALINUX3-SA-2022:0162)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2026/3/7	high
156925	SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:0142-1)	Nessus	SuSE Local Security Checks	2022/1/21	2026/6/26	critical
260825	Linux Distros Unpatched Vulnerability : CVE-2021-30897	Nessus	Misc.	2025/9/3	2025/9/3	medium
293462	MiracleLinux 8 : webkit2gtk3-2.34.6-1.el8.ML.1 (AXSA:2022-3625:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/3/7	high
161003	RHEL 8 : webkit2gtk3 (RHSA-2022:1777)	Nessus	Red Hat Local Security Checks	2022/5/11	2026/3/7	high
161341	Rocky Linux 8 : webkit2gtk3 (RLSA-2022:1777)	Nessus	Rocky Linux Local Security Checks	2022/5/18	2026/3/7	high
157103	SUSE SLED15: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:0182-1)	Nessus	SuSE Local Security Checks	2022/1/26	2026/6/26	critical

检测

插件搜索

critical

high

critical

medium

high

high

high

critical