The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height processing, which makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3     mishandles the a:visited button selector during height processing, which makes it easier for remote     attackers to obtain sensitive browser-history information via a crafted web site. (CVE-2016-1728)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201706-15 (WebKitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebKitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attack can use multiple vectors to execute arbitrary code or       cause a denial of service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of iOS that is prior to version 9.2.1 and the following components contain vulnerabilities :

 - Disk Images
 - IOHIDFamily
 - IOKit
 - Kernel
 - libxslt
 - syslog
 - WebKit
 - WebKit CSS
 - WebSheet

The version of Apple Safari installed on the remote Mac OS X host is prior to 9.0.3. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption vulnerabilities exist in     WebKit due to improper validation of user-supplied     input. A remote attacker, via a specially crafted     website, can exploit these issues to execute arbitrary     code or cause a denial of service. (CVE-2016-1723,     CVE-2016-1724, CVE-2016-1725, CVE-2016-1726,     CVE-2016-1727)

  - A flaw exists in the Cascading Style Sheets (CSS)     implementation in WebKit CSS when handling the     'a:visited button' CSS selector while evaluating the     height of the containing element. A remote attacker     can exploit this, via a crafted website, to obtain     sensitive browser history information. (CVE-2016-1728)

The mobile device is running a version of iOS prior to 9.2.1. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Disk Images
  - IOHIDFamily
  - IOKit
  - Kernel
  - libxslt
  - syslog
  - WebKit
  - WebKit CSS
  - WebSheet

ID	Name	Product	Family	Severity
263747	Linux Distros Unpatched Vulnerability : CVE-2016-1728	Nessus	Misc.	medium
100675	GLSA-201706-15 : WebKitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
9330	Apple iOS < 9.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
88597	Mac OS X : Apple Safari < 9.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
88050	Apple iOS < 9.2.1 Multiple Vulnerabilities	Nessus	Mobile Devices	high

Detections

Analytics

CVE-2016-1728

medium

Tenable Plugins

medium

high

high

high

high