The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1677-1 advisory.

  - A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed     in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be     able to track sensitive user information. (CVE-2022-22594)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS     Monterey 12.3, iOS 15.4 and iPadOS 15.4, tvOS 15.4, Safari 15.4. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2022-22624)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS     Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2022-22628)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2022-22629)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3,     Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected     cross-origin behavior. (CVE-2022-22637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed     in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be     able to track sensitive user information. (CVE-2022-22594)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0690-1 advisory.

    Update to version 2.34.5 (bsc#1195735):

    - CVE-2022-22589: A validation issue was addressed with improved input sanitization.
    - CVE-2022-22590: A use after free issue was addressed with improved memory management.
    - CVE-2022-22592: A logic issue was addressed with improved state management.

    Update to version 2.34.4 (bsc#1195064):

    - CVE-2021-30934: A buffer overflow issue was addressed with improved memory handling.
    - CVE-2021-30936: A use after free issue was addressed with improved memory management.
    - CVE-2021-30951: A use after free issue was addressed with improved memory management.
    - CVE-2021-30952: An integer overflow was addressed with improved input validation.
    - CVE-2021-30953: An out-of-bounds read was addressed with improved bounds checking.
    - CVE-2021-30954: A type confusion issue was addressed with improved memory handling.
    - CVE-2021-30984: A race condition was addressed with improved state handling.
    - CVE-2022-22594: A cross-origin issue in the IndexDB API was addressed with improved input validation.

    The following CVEs were addressed in a previous update:

    - CVE-2021-45481: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create.
    - CVE-2021-45482: A use-after-free in WebCore::ContainerNode::firstChild.
    - CVE-2021-45483: A use-after-free in WebCore::Frame::page.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1777 advisory.

  - webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)

  - webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)

  - webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)

  - webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)

  - webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846, CVE-2021-30848,     CVE-2021-30851)

  - webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)

  - webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

  - webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)

  - webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)

  - webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)

  - webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)

  - webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)

  - webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934, CVE-2021-30936, CVE-2021-30951, CVE-2021-30952, CVE-2021-30953, CVE-2021-30954,     CVE-2021-30984, CVE-2022-22590)

  - webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)

  - webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)

  - webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)

  - webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)

  - webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)

  - webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)

  - webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)

  - webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161238	SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2022:1677-1)	Nessus	SuSE Local Security Checks	2022/5/17	2023/7/13	high
257786	Linux Distros Unpatched Vulnerability : CVE-2022-22594	Nessus	Misc.	2025/8/27	2026/7/17	medium
158620	SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:0690-1)	Nessus	SuSE Local Security Checks	2022/3/5	2026/6/26	high
160908	CentOS 8 : webkit2gtk3 (CESA-2022:1777)	Nessus	CentOS Local Security Checks	2022/5/10	2026/3/7	high
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2026/3/7	critical

检测

插件搜索

high

medium

high

high

critical