According to its banner, the version of Apple TV on the remote device is prior to 12.4. It is therefore affected by multiple vulnerabilities as described in HT210351.

According to its version, the iCloud application installed on the remote Windows host is 7.x prior to 7.13 or 10.x prior to 10.6. It is, therefore, affected by multiple vulnerabilities:

  - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to improper handling of maliciously     crafted content. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2019-8644,     CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677,     CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8685,     CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689)

  - A cross-site scripting (XSS) vulnerability exists with in the WebKit due to improper handling synchronous page loads.
    An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to     execute arbitrary script code in a user's browser session. (CVE-2019-8649)

  - A cross-site scripting (XSS) vulnerability exists with in the WebKit due to improper validation of user-supplied     input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to     click a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2019-8658)

  - A cross-site scripting (XSS) vulnerability exists with in the WebKit due to improper handling of document loads. An     unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute     arbitrary script code in a user's browser session. (CVE-2019-8690)

  - An information disclosure vulnerability exists in the included libxslt library due to improper input validation. An     unauthenticated, remote attacker can exploit this, to disclose potentially sensitive information. (CVE-2019-13118)

This update for webkit2gtk3 fixes the following issues :

Updated to version 2.24.4 (bsc#1148931).

Security issues fixed :

CVE-2019-8644, CVE-2019-8649, CVE-2019-8658, CVE-2019-8669, CVE-2019-8678, CVE-2019-8680, CVE-2019-8683, CVE-2019-8684, CVE-2019-8688, CVE-2019-8595, CVE-2019-8607, CVE-2019-8615, CVE-2019-8644, CVE-2019-8649, CVE-2019-8658, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8690

Non-security issues fixed: Improved loading of multimedia streams to avoid memory exhaustion due to excessive caching.

Updated the user agent string to make happy certain websites which would claim that the browser being used was unsupported.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4130-1 advisory.

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user     were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related     to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
127048	Apple TV < 12.4 Multiple Vulnerabilities	Nessus	Misc.	2019/7/26	2022/5/19	critical
127914	Apple iCloud 7.x < 7.13 / 10.x < 10.6 Multiple Vulnerabilities	Nessus	Windows	2019/8/20	2021/1/29	high
128675	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2019:2345-1)	Nessus	SuSE Local Security Checks	2019/9/11	2024/4/26	high
128755	Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-4130-1)	Nessus	Ubuntu Local Security Checks	2019/9/12	2024/8/27	high

偵測

搜尋 Plugin

critical

high

high

high