The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:2863 advisory.

    * webkitgtk: out-of-bounds write vulnerability (CVE-2025-24201)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This     issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2     and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted     web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack     that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an     extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).
    (CVE-2025-24201)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02766-1 advisory.

    Updated to version 2.48.5:
      - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to     memory corruption. (bsc#1247564)
      - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web content may lead to     memory corruption. (bsc#1247563)
      - CVE-2025-43211: Fixed a vulnerability where processing web content may lead to a denial-of-service.
    (bsc#1247562)
      - CVE-2025-43212: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247595)
      - CVE-2025-43216: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247596)
      - CVE-2025-43227: Fixed a vulnerability where processing maliciously crafted web content may disclose     sensitive user information. (bsc#1247597)
      - CVE-2025-43228: Fixed a vulnerability where visiting a malicious website may lead to address bar     spoofing. (bsc#1247598)
      - CVE-2025-43240: Fixed a vulnerability where a download's origin may be incorrectly associated.
    (bsc#1247599)
      - CVE-2025-43265: Fixed a vulnerability where processing maliciously crafted web content may disclose     internal states of the app. (bsc#1247600)
      - CVE-2025-6558: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247742)

    Other fixes:
    - Improve emoji font selection with USE_SKIA=ON.
    - Improve playback of multimedia streams from blob URLs.
    - Fix the build with USE_SKIA_OPENTYPE_SVG=ON and       USE_SYSPROF_CAPTURE=ON.
    - Fix crash when using a WebKitWebView widget in an offscreen       window.
    - Fix several crashes and rendering issues.
    - Fix a crash introduced by the new threaded rendering       implementation using Skia API.
    - Improve rendering performance by recording layers once and       replaying every dirty region in different worker threads.
    - Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
    - Fix a reference cycle in webkitmediastreamsrc preventing its       disposal.
    - Increase mem_per_process again to avoid running out of memory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02765-1 advisory.

    Updated to version 2.48.5:
      - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to     memory corruption. (bsc#1247564)
      - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web content may lead to     memory corruption. (bsc#1247563)
      - CVE-2025-43211: Fixed a vulnerability where processing web content may lead to a denial-of-service.
    (bsc#1247562)
      - CVE-2025-43212: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247595)
      - CVE-2025-43216: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247596)
      - CVE-2025-43227: Fixed a vulnerability where processing maliciously crafted web content may disclose     sensitive user information. (bsc#1247597)
      - CVE-2025-43228: Fixed a vulnerability where visiting a malicious website may lead to address bar     spoofing. (bsc#1247598)
      - CVE-2025-43240: Fixed a vulnerability where a download's origin may be incorrectly associated.
    (bsc#1247599)
      - CVE-2025-43265: Fixed a vulnerability where processing maliciously crafted web content may disclose     internal states of the app. (bsc#1247600)
      - CVE-2025-6558: Fixed a vulnerability where processing maliciously crafted web content may lead to an     unexpected Safari crash. (bsc#1247742)

    Other fixes:
    - Improve emoji font selection with USE_SKIA=ON.
    - Improve playback of multimedia streams from blob URLs.
    - Fix the build with USE_SKIA_OPENTYPE_SVG=ON and       USE_SYSPROF_CAPTURE=ON.
    - Fix crash when using a WebKitWebView widget in an offscreen       window.
    - Fix several crashes and rendering issues.
    - Fix a crash introduced by the new threaded rendering       implementation using Skia API.
    - Improve rendering performance by recording layers once and       replaying every dirty region in different worker threads.
    - Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
    - Fix a reference cycle in webkitmediastreamsrc preventing its       disposal.
    - Increase mem_per_process again to avoid running out of memory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748626479 advisory.

  - An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This     issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2     and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted     web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack     that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an     extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).
    (CVE-2025-24201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5877 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5877-1                   security@debian.org     https://www.debian.org/security/                           Andres Salomon     March 12, 2025                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : chromium     CVE ID         : CVE-2025-1920 CVE-2025-2135 CVE-2025-2136 CVE-2025-2137                      CVE-2025-24201

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For the stable distribution (bookworm), these problems have been fixed in     version 134.0.6998.88-1~deb12u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0975-1 advisory.

    - CVE-2025-24201: Fixed out-of-bounds write vulnerability due to that WebGL context primitive restart       can be toggled from WebContent process (bsc#1239547).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3002 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: out-of-bounds write vulnerability (CVE-2025-24201)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7395-1 advisory.

    Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were     tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to     web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0046 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-24201:
    An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This     issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1.
    Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary     fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been     exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS     before iOS 17.2.).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of webkitgtk4 installed on the remote host is prior to 2.46.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2869 advisory.

    The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2,     macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing     maliciously crafted web content may lead to memory corruption. (CVE-2023-43010)

    The issue was addressed with improved UI handling. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4,     visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, Safari 17.4. A malicious website may exfiltrate     audio data cross-origin. (CVE-2024-23254)

    A logic issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, Safari     17.3, tvOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A malicious website may cause unexpected cross-origin     behavior. (CVE-2024-23271)

    The issue was addressed with improved memory handling. This issue is fixed in tvOS 17.5, visionOS 1.2,     Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing web content may lead to     arbitrary code execution. (CVE-2024-27808)

    The issue was addressed with improved memory handling. This issue is fixed in tvOS 17.5, iOS 16.7.8 and     iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5.
    Processing web content may lead to arbitrary code execution. (CVE-2024-27820)

    This issue was addressed through improved state management. This issue is fixed in tvOS 17.5, visionOS     1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A maliciously crafted webpage     may be able to fingerprint the user. (CVE-2024-27830)

    An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 17.5, iOS     16.7.8 and iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2024-27833)

    The issue was addressed by adding additional logic. This issue is fixed in tvOS 17.5, iOS 16.7.8 and     iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A     maliciously crafted webpage may be able to fingerprint the user. (CVE-2024-27838)

    This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in     visionOS 1.2, macOS Sonoma 14.5, Safari 17.5, iOS 17.5 and iPadOS 17.5. A maliciously crafted webpage may     be able to fingerprint the user. (CVE-2024-27850)

    The issue was addressed with improved bounds checks. This issue is fixed in tvOS 17.5, visionOS 1.2,     Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2024-27851)

    The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, iOS 16.7.8 and     iPadOS 16.7.8, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, tvOS 17.5, visionOS 1.2. Processing a     file may lead to unexpected app termination or arbitrary code execution. (CVE-2024-27856)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.7.9     and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS     Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash.
    (CVE-2024-40782)

    This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2,     watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content     may lead to universal cross site scripting. (CVE-2024-40857)

    The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a     malicious website may lead to address bar spoofing. (CVE-2024-40866)

    The issue was addressed with improved checks. This issue is fixed in tvOS 17.6, visionOS 1.3, Safari 17.6,     watchOS 10.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Processing maliciously crafted web content may     lead to an unexpected process crash. (CVE-2024-44185)

    A cross-origin issue existed with iframe elements. This was addressed with improved tracking of security     origins. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18,     tvOS 18. A malicious website may exfiltrate data cross-origin. (CVE-2024-44187)

    The issue was addressed with improved checks. This issue is fixed in watchOS 11, macOS Sequoia 15, Safari     18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to an     unexpected process crash. (CVE-2024-44192)

    A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 18.1     and iPadOS 18.1, watchOS 11.1, visionOS 2.1, tvOS 18.1, macOS Sequoia 15.1, Safari 18.1. Processing     maliciously crafted web content may lead to an unexpected process crash. (CVE-2024-44244)

    The issue was addressed with improved checks. This issue is fixed in tvOS 18.1, iOS 18.1 and iPadOS 18.1,     iOS 17.7.1 and iPadOS 17.7.1, watchOS 11.1, visionOS 2.1, macOS Sequoia 15.1, Safari 18.1. Processing     maliciously crafted web content may prevent Content Security Policy from being enforced. (CVE-2024-44296)

    A cookie management issue was addressed with improved state management. This issue is fixed in Safari     18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1.
    Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a     report that this issue may have been actively exploited on Intel-based Mac systems. (CVE-2024-44309)

    The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS     2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted     web content may lead to an unexpected process crash. (CVE-2024-54479)

    The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS     18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web     content may lead to an unexpected process crash. (CVE-2024-54502)

    A type confusion issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3,     watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2.
    Processing maliciously crafted web content may lead to memory corruption. (CVE-2024-54505)

    The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2,     tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web     content may lead to an unexpected process crash. (CVE-2024-54508)

    The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2,     tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web     content may lead to memory corruption. (CVE-2024-54534)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.2, tvOS 18.2,     Safari 18.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. Processing maliciously crafted     web content may lead to memory corruption. (CVE-2024-54543)

    The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.6, tvOS 17.6,     Safari 17.6, macOS Sonoma 14.6, visionOS 1.3, iOS 17.6 and iPadOS 17.6. Processing web content may lead to     a denial-of-service. (CVE-2024-54551)

    The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4,     Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, macOS Sonoma 14.4. Processing web content may lead to     a denial-of-service. (CVE-2024-54658)

    The issue was addressed with improved access restrictions to the file system. This issue is fixed in macOS     Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. A maliciously crafted webpage may be     able to fingerprint the user. (CVE-2025-24143)

    A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sequoia 15.3,     Safari 18.3, iOS 18.3 and iPadOS 18.3. Copying a URL from Web Inspector may lead to command injection.
    (CVE-2025-24150)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, Safari 18.3,     iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing web content may lead to     a denial-of-service. (CVE-2025-24158)

    This issue was addressed through improved state management. This issue is fixed in visionOS 2.3, Safari     18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously     crafted web content may lead to an unexpected process crash. (CVE-2025-24162)

    An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This     issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1.
    Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary     fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been     exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS     before iOS 17.2.). (CVE-2025-24201)

    A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS     18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.
    (CVE-2025-24208)

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 18.4,     Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted     web content may lead to an unexpected process crash. (CVE-2025-24209)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4,     iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted     web content may lead to an unexpected Safari crash. (CVE-2025-24216)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4,     iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted     web content may lead to an unexpected Safari crash. (CVE-2025-24264)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in visionOS 2.4,     tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing     maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2025-30427)

    The issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS     26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A malicious website may exfiltrate data cross-origin.
    (CVE-2025-43480)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02973-1 advisory.

    - Update to version 2.48.5:
      - CVE-2025-31273: Fixed processing maliciously crafted web content leading to memory corruption     (bsc#1247564)
      - CVE-2025-43265: Fixed processing maliciously crafted web content disclosing internal states of the app     (bsc#1247600)
      - CVE-2025-43216: Fixed processing maliciously crafted web content leading to an unexpected Safari crash     (bsc#1247596)
      - CVE-2025-31278: Fixed processing maliciously crafted web content leading to memory corruption     (bsc#1247563)
      - CVE-2025-6558: Fixed processing maliciously crafted web content leading to an unexpected Safari crash.
    (bsc#1247742)
      - CVE-2025-43227: Fixed Processing maliciously crafted web content disclosing sensitive user information     (bsc#1247597)
      - CVE-2025-43240: Fixed downloads origin incorrectly associated (bsc#1247599)
      - CVE-2025-43228: Fixed visiting a malicious website leading to address bar spoofing (bsc#1247598)
      - CVE-2025-43212: Fixed processing maliciously crafted web content leading to an unexpected Safari crash     (bsc#1247595)
      - CVE-2025-43211: Fixed processing web content leading to a denial-of-service (bsc#1247562)
      - Fix several crashes.
      - Changes in version 2.48.4:
      - Improve emoji font selection with USE_SKIA=ON.
      - Improve playback of multimedia streams from blob URLs.
      - Fix the build with USE_SKIA_OPENTYPE_SVG=ON and         USE_SYSPROF_CAPTURE=ON.
      - Fix the build on LoongArch with USE_SKIA=ON.
      - Fix crash when using a WebKitWebView widget in an offscreen         window.
      - Fix several crashes and rendering issues.
      - Changes in version 2.48.3:
      - Fix a crash introduced by the new threaded rendering         implementation using Skia API.
      - Improve rendering performance by recording layers once and         replaying every dirty region in different worker threads.
      - Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
      - Fix a reference cycle in webkitmediastreamsrc preventing its         disposal.

    - CVE-2024-44192:Fixed processing maliciously crafted web content leading to an unexpected process crash     (bsc#1239863)
    - CVE-2024-54467: Fixed data cross-origin exfiltration due to a cookie management issue (bsc#1239864)
    - CVE-2025-24201: Fixed out-of-bounds write vulnerability (bsc#1239547)
    - CVE-2025-24189: Fixed processing maliciously crafted web content leading to memory corruption     (bsc#1247565)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9774:06 advisory.

    * webkitgtk: out-of-bounds write vulnerability (CVE-2025-24201)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9773:05 advisory.

    * webkitgtk: out-of-bounds write vulnerability (CVE-2025-24201)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
235566	RockyLinux 8 : webkit2gtk3 (RLSA-2025:2863)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	high
245921	Linux Distros Unpatched Vulnerability : CVE-2025-24201	Nessus	Misc.	2025/8/8	2026/11/5	critical
249218	SUSE SLES15: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2025:02766-1)	Nessus	SuSE Local Security Checks	2025/8/13	2026/6/25	critical
249227	SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2025:02765-1)	Nessus	SuSE Local Security Checks	2025/8/13	2026/6/26	critical
351641	AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1748626479)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	critical
232663	Debian dsa-5877 : chromium - security update	Nessus	Debian Local Security Checks	2025/3/12	2025/3/21	high
233210	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2025:0975-1)	Nessus	SuSE Local Security Checks	2025/3/22	2025/3/22	high
233222	RHEL 8 : webkit2gtk3 (RHSA-2025:3002)	Nessus	Red Hat Local Security Checks	2025/3/22	2025/6/5	high
233562	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : WebKitGTK vulnerabilities (USN-7395-1)	Nessus	Ubuntu Local Security Checks	2025/3/31	2025/3/31	high
236231	Alibaba Cloud Linux 3 : 0046: webkit2gtk3 (ALINUX3-SA-2025:0046)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
237469	Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2025-2869 (ALAS-2025-2869)	Nessus	Amazon Linux Local Security Checks	2025/5/29	2026/3/25	critical
255211	SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2025:02973-1)	Nessus	SuSE Local Security Checks	2025/8/26	2026/6/26	critical
282824	MiracleLinux 8 : webkit2gtk3-2.46.6-2.el8_10.ML.1 (AXSA:2025-9774:06)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/16	critical
283128	MiracleLinux 9 : webkit2gtk3-2.46.6-2.el9_5 (AXSA:2025-9773:05)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/16	critical

检测

插件搜索

high

critical

critical

critical

critical

high

high

high

high

high

critical

critical

critical

critical