远程主机受到 GLSA-202104-03 中所述漏洞的影响（WebkitGTK+：多个漏洞）

    已在 WebkitGTK+ 中发现多个漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    攻击者通过诱骗用户访问恶意构建的 Web 内容，或可执行任意代码，违反 iframe 沙盒策略，访问任意服务器上的受限端口，造成内存损坏，或可能造成拒绝服务情况。
  变通方案：

    目前无任何已知的变通方案。

遠端主機執行的 macOS/Mac OS X 版本為 10.14.x 版 10.14.6 之前版本的安全性更新 2021-001 Mojave，10.15.x 版 10.15.7 之前版本的安全性更新 2021-001 Catalina 或 11.x 版 11.2 之前版本。因此會受到包括以下在內的多個弱點影響：

  - 存在一個邏輯問題，會導致記憶體損毀。現已透過改進狀態管理解決了此問題。
    應用程式可以透過核心權限執行任意程式碼。(CVE-2020-27904)

  - 存在一個邏輯問題，會允許應用程式以核心權限執行任意程式碼。
    (CVE-2021-1750)

  - 存在因為輸入驗證不當造成的超出邊界寫入問題，允許惡意特製的 USD 檔案意外終止應用程式或造成任意程式碼執行。(CVE-2021-1762)

請注意，Nessus 並未測試此問題，而是僅依據作業系統自我報告的版本號碼。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 已透過改進限制解決一個邏輯問題。此問題已在 macOS Big Sur 11.2、安全性更新 2021-001 Catalina、安全性更新 2021-001 Mojave、iOS 14.4 和 iPadOS 14.4 中得到修正。遠端攻擊者或可造成任意程式碼執行。Apple 獲報告指出此問題可能已經遭到惡意利用.. (CVE-2021-1870)

請注意，Nessus 依賴供應商報告的套件存在。

遠端主機受到 GLSA-202104-03 中所述的弱點影響 (WebkitGTK+：多個弱點)

    在 WebkitGTK+ 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    攻擊者可引誘使用者造訪惡意特製的 Web 內容，從而可能執行任意程式碼，違反 iframe 沙箱原則，存取任意伺服器上的受限連接埠，造成記憶體損毀，或可能造成拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

The remote host is affected by the vulnerability described in GLSA-202104-03 (WebkitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebkitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker, by enticing a user to visit maliciously crafted web       content, may be able to execute arbitrary code, violate iframe sandboxing       policy, access restricted ports on arbitrary servers, cause memory       corruption, or could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.6 Security Update 2021-001 Mojave, 10.15.x prior to 10.15.7 Security Update 2021-001 Catalina, or 11.x prior to 11.2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A logic issue existed resulting in memory corruption. This was addressed with improved state management.
    An application may be able to execute arbitrary code with kernel privileges. (CVE-2020-27904)

  - A logic issue existed that allowed applications to execute arbitrary code with kernel privileges.
    (CVE-2021-1750)

  - An out-of-bounds-write caused by improper input validation allowed maliciously crafted USD files to     unexpectedly terminate an application or cause arbitrary code execution. (CVE-2021-1762)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

This update for webkit2gtk3 fixes the following issues :

  - Update to version 2.32.0 (bsc#1184155) :

  - Fix the authentication request port when URL omits the     port.

  - Fix iframe scrolling when main frame is scrolled in     async

  - scrolling mode.

  - Stop using g_memdup.

  - Show a warning message when overriding signal handler     for

  - threading suspension.

  - Fix the build on RISC-V with GCC 11.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2021-1788, CVE-2021-1844,     CVE-2021-1871

  - Update in version 2.30.6 (bsc#1184262) :

  - Update user agent quirks again for Google Docs and     Google Drive.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2020-27918, CVE-2020-29623,     CVE-2021-1765 CVE-2021-1789, CVE-2021-1799,     CVE-2021-1801, CVE-2021-1870.

  - Update _constraints for armv6/armv7 (bsc#1182719)

  - restore NPAPI plugin support which was removed in 2.32.0

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1870)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities:

  - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in     versions prior to 2.30.5. Processing maliciously crafted web content may lead to arbitrary code execution.
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-13558)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27918)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully     delete the browsing history under some circumstances. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-29623)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content     may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
    (CVE-2021-1765, CVE-2021-1801)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-1788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
149222	GLSA-202104-03：WebkitGTK+：多个漏洞	Nessus	Gentoo Local Security Checks	2021/5/3	2022/5/6	critical
241427	RHEL 7：webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/10/21	critical
146086	macOS 10.14.x < 10.14.6 安全性更新 2021-001 / 10.15.x < 10.15.7 安全性更新 2021-001 / macOS 11.x < 11.2 (HT212147)	Nessus	MacOS X Local Security Checks	2021/2/3	2024/5/28	critical
223608	Linux Distros 未修補弱點：CVE-2021-1870	Nessus	Misc.	2025/3/4	2025/9/14	critical
149222	GLSA-202104-03：WebkitGTK+：多個弱點	Nessus	Gentoo Local Security Checks	2021/5/3	2022/5/6	critical
241427	RHEL 7：webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/10/21	critical
149222	GLSA-202104-03 : WebkitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2021/5/3	2022/5/6	critical
146086	macOS 10.14.x < 10.14.6 Security Update 2021-001 / 10.15.x < 10.15.7 Security Update 2021-001 / macOS 11.x < 11.2 (HT212147)	Nessus	MacOS X Local Security Checks	2021/2/3	2024/5/28	critical
149570	openSUSE Security Update : webkit2gtk3 (openSUSE-2021-637)	Nessus	SuSE Local Security Checks	2021/5/18	2023/4/25	critical
223608	Linux Distros Unpatched Vulnerability : CVE-2021-1870	Nessus	Misc.	2025/3/4	2025/9/14	critical
206839	NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	2025/7/7	2025/10/21	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical