According to the versions of the libwebp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a     remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2023-4863)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libwebp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a     remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2023-4863)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:5201 advisory.

  - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a     remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2023-4863)

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of     CVE-2023-4863. (CVE-2023-5129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libwebp packages installed that are affected by multiple vulnerabilities:

  - A heap-based buffer flaw was found in the way libwebp, a library used to process WebP image format data,     processes certain specially formatted WebP images. An attacker could use this flaw to crash or execute     remotely arbitrary code in an application such as a web browser compiled with this library.
    (CVE-2023-4863)

  - This CVE ID has been rejected by its CVE Numbering Authority. Duplicate of CVE-2023-4863. (CVE-2023-5129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-381 advisory.

  - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a     remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2023-4863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4618764c6e advisory.

    Update to 102.13.0 ;
    https://www.mozilla.org/en-US/security/advisories/mfsa2023-24/ ;
    https://www.thunderbird.net/en-US/thunderbird/102.13.0/releasenotes/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 116.0.5845.187. It is, therefore, affected by a vulnerability as referenced in the 2023_09_stable-channel-update-for-desktop_11 advisory.

  - Heap buffer overflow in WebP. (CVE-2023-4863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 102.15.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-40 advisory.

  - Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware     of this issue being exploited in other products in the wild. (CVE-2023-4863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5497 advisory.

    A buffer overflow in parsing WebP images may result in the execution of arbitrary code. For the stable     distribution (bookworm), this problem has been fixed in version 1.2.4-0.2+deb12u1. We recommend that you     upgrade your libwebp packages. For the detailed security status of libwebp please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/libwebp

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5496 advisory.

  - Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform     an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2023-4863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge installed on the remote Windows host is prior to 117.0.2045.31. It is, therefore, affected by multiple vulnerabilities as referenced in the September 15, 2023 advisory.

  - Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVE-2023-36562, CVE-2023-36735)

  - Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVE-2023-36727)

  - Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform     an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2023-4863)

  - Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a     remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity:
    Medium) (CVE-2023-4900)

  - Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker     to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2023-4901)

  - Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to     spoof security UI via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-4902)

  - Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62     allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity:
    Medium) (CVE-2023-4903)

  - Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote     attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity:
    Medium) (CVE-2023-4904)

  - Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker     to spoof security UI via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-4905)

  - Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote     attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)     (CVE-2023-4906)

  - Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a     remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)     (CVE-2023-4907)

  - Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a     remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)     (CVE-2023-4908)

  - Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote     attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)     (CVE-2023-4909)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5204 advisory.

    The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format     with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format,     and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and     browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

    Security Fix(es):

    * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5187 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.15.1 ESR.

    Security Fix(es):

    * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-5184 advisory.

    [102.15.1-1.0.1]
    - Update to 102.15.1 build2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5214 advisory.

    [1.2.0-7]
    - Added fix for CVE-2023-4863

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
188448	EulerOS 2.0 SP11 : libwebp (EulerOS-SA-2023-3276)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/17	high
188501	EulerOS Virtualization 2.10.1 : libwebp (EulerOS-SA-2023-3505)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/17	high
188587	EulerOS 2.0 SP9 : libwebp (EulerOS-SA-2023-3341)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/17	high
190138	CentOS 8 : thunderbird (CESA-2023:5201)	Nessus	CentOS Local Security Checks	2024/2/8	2024/2/9	high
206838	NewStart CGSL MAIN 6.02 : libwebp Multiple Vulnerabilities (NS-SA-2024-0067)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/11	high
214092	Fortinet FortiClient CVE-2023-4863 - Heap overflow in Chrome/libwebp (FG-IR-23-381)	Nessus	Windows	2025/1/14	2025/1/16	high
178792	Fedora 37 : thunderbird (2023-4618764c6e)	Nessus	Fedora Local Security Checks	2023/7/26	2024/11/15	high
181236	Google Chrome < 116.0.5845.187 Vulnerability	Nessus	MacOS X Local Security Checks	2023/9/11	2023/10/2	high
181352	Mozilla Firefox ESR < 102.15.1	Nessus	Windows	2023/9/13	2023/10/6	high
181446	Debian DSA-5497-1 : libwebp - security update	Nessus	Debian Local Security Checks	2023/9/14	2025/1/27	high
181448	Debian DSA-5496-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	2023/9/14	2023/10/6	high
181483	Microsoft Edge (Chromium) < 117.0.2045.31 Multiple Vulnerabilities	Nessus	Windows	2023/9/15	2025/1/1	high
181525	RHEL 9 : libwebp (RHSA-2023:5204)	Nessus	Red Hat Local Security Checks	2023/9/18	2024/11/8	high
181527	RHEL 8 : firefox (RHSA-2023:5187)	Nessus	Red Hat Local Security Checks	2023/9/18	2024/11/8	high
181568	Oracle Linux 8 : firefox (ELSA-2023-5184)	Nessus	Oracle Linux Local Security Checks	2023/9/19	2025/9/11	high
181644	Oracle Linux 9 : libwebp (ELSA-2023-5214)	Nessus	Oracle Linux Local Security Checks	2023/9/19	2025/9/11	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high