The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big     Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS     14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on     arbitrary servers. (CVE-2021-1799)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-864dc37032 advisory.

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes     12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-27918)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content     may violate iframe sandboxing policy. (CVE-2021-1765)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1788)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1789)

  - A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big     Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS     14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on     arbitrary servers. (CVE-2021-1799)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4     and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy. (CVE-2021-1801)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-1844)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1870, CVE-2021-1871)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1990-1 advisory.

  - A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A     specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code     execution. An attacker can get a user to visit a webpage to trigger this vulnerability. (CVE-2020-13543)

  - A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit     WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free. (CVE-2020-13558)

  - An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially     crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The     victim needs to visit a malicious web site to trigger this vulnerability. (CVE-2020-13584)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes     12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-27918)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

  - A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0,     iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0, Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9947)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9948)

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2020-9951)

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari     14.0. Processing maliciously crafted web content may lead to code execution. (CVE-2020-9983)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content     may violate iframe sandboxing policy. (CVE-2021-1765)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1788)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1789)

  - A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big     Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS     14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on     arbitrary servers. (CVE-2021-1799)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4     and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy. (CVE-2021-1801)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-1844)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1870, CVE-2021-1871)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following vulnerabilities have been discovered in the webkit2gtk web engine :

  - CVE-2020-27918     Liu Long discovered that processing maliciously crafted     web content may lead to arbitrary code execution.

  - CVE-2020-29623     Simon Hunt discovered that users may be unable to fully     delete their browsing history under some circumstances.

  - CVE-2021-1765     Eliya Stein discovered that maliciously crafted web     content may violate iframe sandboxing policy.

  - CVE-2021-1789     @S0rryMybad discovered that processing maliciously     crafted web content may lead to arbitrary code     execution.

  - CVE-2021-1799     Gregory Vishnepolsky, Ben Seri and Samy Kamkar     discovered that a malicious website may be able to     access restricted ports on arbitrary servers.

  - CVE-2021-1801     Eliya Stein discovered that processing maliciously     crafted web content may lead to arbitrary code     execution.

  - CVE-2021-1870     An anonymous researcher discovered that processing     maliciously crafted web content may lead to arbitrary     code execution.

This update for webkit2gtk3 fixes the following issues :

Update to version 2.32.0 (bsc#1184155) :

  - Fix the authentication request port when URL omits the     port.

  - Fix iframe scrolling when main frame is scrolled in     async

  - scrolling mode.

  - Stop using g_memdup.

  - Show a warning message when overriding signal handler     for

  - threading suspension.

  - Fix the build on RISC-V with GCC 11.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2021-1788, CVE-2021-1844,     CVE-2021-1871

Update in version 2.30.6 (bsc#1184262) :

  - Update user agent quirks again for Google Docs and     Google Drive.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2020-27918, CVE-2020-29623,     CVE-2021-1765 CVE-2021-1789, CVE-2021-1799,     CVE-2021-1801, CVE-2021-1870.

Update _constraints for armv6/armv7 (bsc#1182719)

restore NPAPI plugin support which was removed in 2.32.0

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

遠端主機受到 GLSA-202104-03 中所述的弱點影響 (WebkitGTK+：多個弱點)

    在 WebkitGTK+ 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    攻擊者可引誘使用者造訪惡意特製的 Web 內容，從而可能執行任意程式碼，違反 iframe 沙箱原則，存取任意伺服器上的受限連接埠，造成記憶體損毀，或可能造成拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

遠端主機執行的 macOS/Mac OS X 版本為 10.14.x 版 10.14.6 之前版本的安全性更新 2021-001 Mojave，10.15.x 版 10.15.7 之前版本的安全性更新 2021-001 Catalina 或 11.x 版 11.2 之前版本。因此會受到包括以下在內的多個弱點影響：

  - 存在一個邏輯問題，會導致記憶體損毀。現已透過改進狀態管理解決了此問題。
    應用程式可以透過核心權限執行任意程式碼。(CVE-2020-27904)

  - 存在一個邏輯問題，會允許應用程式以核心權限執行任意程式碼。
    (CVE-2021-1750)

  - 存在因為輸入驗證不當造成的超出邊界寫入問題，允許惡意特製的 USD 檔案意外終止應用程式或造成任意程式碼執行。(CVE-2021-1762)

請注意，Nessus 並未測試此問題，而是僅依據作業系統自我報告的版本號碼。

This update for webkit2gtk3 fixes the following issues :

  - Update to version 2.32.0 (bsc#1184155) :

  - Fix the authentication request port when URL omits the     port.

  - Fix iframe scrolling when main frame is scrolled in     async

  - scrolling mode.

  - Stop using g_memdup.

  - Show a warning message when overriding signal handler     for

  - threading suspension.

  - Fix the build on RISC-V with GCC 11.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2021-1788, CVE-2021-1844,     CVE-2021-1871

  - Update in version 2.30.6 (bsc#1184262) :

  - Update user agent quirks again for Google Docs and     Google Drive.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2020-27918, CVE-2020-29623,     CVE-2021-1765 CVE-2021-1789, CVE-2021-1799,     CVE-2021-1801, CVE-2021-1870.

  - Update _constraints for armv6/armv7 (bsc#1182719)

  - restore NPAPI plugin support which was removed in 2.32.0

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-202104-03 (WebkitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebkitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker, by enticing a user to visit maliciously crafted web       content, may be able to execute arbitrary code, violate iframe sandboxing       policy, access restricted ports on arbitrary servers, cause memory       corruption, or could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.6 Security Update 2021-001 Mojave, 10.15.x prior to 10.15.7 Security Update 2021-001 Catalina, or 11.x prior to 11.2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A logic issue existed resulting in memory corruption. This was addressed with improved state management.
    An application may be able to execute arbitrary code with kernel privileges. (CVE-2020-27904)

  - A logic issue existed that allowed applications to execute arbitrary code with kernel privileges.
    (CVE-2021-1750)

  - An out-of-bounds-write caused by improper input validation allowed maliciously crafted USD files to     unexpectedly terminate an application or cause arbitrary code execution. (CVE-2021-1762)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities:

  - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in     versions prior to 2.30.5. Processing maliciously crafted web content may lead to arbitrary code execution.
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-13558)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27918)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully     delete the browsing history under some circumstances. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-29623)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content     may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
    (CVE-2021-1765, CVE-2021-1801)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-1788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
259608	Linux Distros Unpatched Vulnerability : CVE-2021-1799	Nessus	Misc.	2025/8/30	2025/8/30	medium
148778	Fedora 33 : webkit2gtk3 (2021-864dc37032)	Nessus	Fedora Local Security Checks	2021/4/19	2023/4/25	critical
150913	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2021:1990-1)	Nessus	SuSE Local Security Checks	2021/6/21	2023/7/13	critical
148236	Debian DSA-4877-1 : webkit2gtk - security update	Nessus	Debian Local Security Checks	2021/3/30	2022/5/6	critical
149203	SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2021:1430-1)	Nessus	SuSE Local Security Checks	2021/4/30	2023/4/25	critical
149222	GLSA-202104-03：WebkitGTK+：多個弱點	Nessus	Gentoo Local Security Checks	2021/5/3	2022/5/6	critical
146086	macOS 10.14.x < 10.14.6 安全性更新 2021-001 / 10.15.x < 10.15.7 安全性更新 2021-001 / macOS 11.x < 11.2 (HT212147)	Nessus	MacOS X Local Security Checks	2021/2/3	2024/5/28	critical
241427	RHEL 7：webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/10/21	critical
149570	openSUSE Security Update : webkit2gtk3 (openSUSE-2021-637)	Nessus	SuSE Local Security Checks	2021/5/18	2023/4/25	critical
149222	GLSA-202104-03 : WebkitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2021/5/3	2022/5/6	critical
146086	macOS 10.14.x < 10.14.6 Security Update 2021-001 / 10.15.x < 10.15.7 Security Update 2021-001 / macOS 11.x < 11.2 (HT212147)	Nessus	MacOS X Local Security Checks	2021/2/3	2024/5/28	critical
206839	NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/10/21	critical

偵測

搜尋 Plugin

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical