The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1777 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.34.6). (BZ#1985042)

    Security Fix(es):

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)

    * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)

    * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)

    * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)

    * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)

    * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)

    * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)

    * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)

    * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)

    * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)

    * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)

    * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)

    * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)

    * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)

    * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)

    * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)

    * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1777 advisory.

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2021-30809)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30818)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS. (CVE-2021-30823)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory. (CVE-2021-30836)

  - The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history. (CVE-2021-30884)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy. (CVE-2021-30887)

  - An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30889)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-30890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In WebKitGTK before 2.32.4, there is incorrect memory allocation in     WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application     crash, a different vulnerability than CVE-2021-30889. (CVE-2021-45481)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3625:01 advisory.

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)
      * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)
      * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)
      * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)
      * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)
      * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)
      * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)
      * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)
      * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)
      * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)
      * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)
      * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)
      * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)
      * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)
      * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)
      * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)
      * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)
      * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0705-1 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2,     macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2021-30934)

  - A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2,     macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2021-30936, CVE-2021-30951)

  - An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS     Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30952)

  - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2, macOS     Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30953)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2,     macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2021-30954)

  - A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2, macOS     Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30984)

  - In WebKitGTK before 2.32.4, there is incorrect memory allocation in     WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application     crash, a different vulnerability than CVE-2021-30889. (CVE-2021-45481)

  - In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different     vulnerability than CVE-2021-30889. (CVE-2021-45482)

  - In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability     than CVE-2021-30889. (CVE-2021-45483)

  - A validation issue was addressed with improved input sanitization. (CVE-2022-22589)

  - A use after free issue was addressed with improved memory management. (CVE-2022-22590, CVE-2022-22620)

  - A logic issue was addressed with improved state management. (CVE-2022-22592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1777 advisory.

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)

    * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)

    * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)

    * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)

    * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)

    * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)

    * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)

    * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)

    * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)

    * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)

    * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)

    * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)

    * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)

    * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)

    * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)

    * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)

    * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
161003	RHEL 8 : webkit2gtk3 (RHSA-2022:1777)	Nessus	Red Hat Local Security Checks	2022/5/11	2026/3/7	high
161341	Rocky Linux 8 : webkit2gtk3 (RLSA-2022:1777)	Nessus	Rocky Linux Local Security Checks	2022/5/18	2026/3/7	high
256830	Linux Distros Unpatched Vulnerability : CVE-2021-45481	Nessus	Misc.	2025/8/27	2026/7/17	medium
293462	MiracleLinux 8 : webkit2gtk3-2.34.6-1.el8.ML.1 (AXSA:2022-3625:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/3/7	high
158635	openSUSE 15 Security Update : webkit2gtk3 (openSUSE-SU-2022:0705-1)	Nessus	SuSE Local Security Checks	2022/3/5	2026/3/7	high
358031	Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2022_1777)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
276044	TencentOS Server 2: webkitgtk4 (TSSA-2025:0554)	Nessus	Tencent Local Security Checks	2025/11/20	2026/11/5	critical

偵測

搜尋 Plugin

high

high

medium

high

high

high

critical