https://support.apple.com/kb/HT209106

https://support.apple.com/kb/HT209107

https://support.apple.com/kb/HT209109

https://support.apple.com/kb/HT209140

https://support.apple.com/kb/HT209141

The version of Apple iOS running on the mobile device is prior to 12.0. It is, therefore, affected by multiple vulnerabilities.

The version of Apple Safari installed on the remote host is prior to 12. It is, therefore, affected by multiple vulnerabilities.

This update for webkit2gtk3 to version 2.22.5 fixes the following issues :

Security issues fixed :

  - CVE-2018-4372, CVE-2018-4345, CVE-2018-4386,     CVE-2018-4375, CVE-2018-4376, CVE-2018-4378,     CVE-2018-4382, CVE-2018-4392, CVE-2018-4416,     CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,     CVE-2018-4306, CVE-2018-4309, CVE-2018-4312,     CVE-2018-4314, CVE-2018-4315, CVE-2018-4316,     CVE-2018-4317, CVE-2018-4318, CVE-2018-4319,     CVE-2018-4323, CVE-2018-4328, CVE-2018-4358,     CVE-2018-4359, CVE-2018-4361, CVE-2018-4373,     CVE-2018-4162, CVE-2018-4163, CVE-2018-4165,     CVE-2018-11713, CVE-2018-4207, CVE-2018-4208,     CVE-2018-4209, CVE-2018-4210, CVE-2018-4212,     CVE-2018-4213, CVE-2018-4437, CVE-2018-4438,     CVE-2018-4441, CVE-2018-4442, CVE-2018-4443,     CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

This update was imported from the SUSE:SLE-15:Update update project.

This update for webkit2gtk3 to version 2.22.4 fixes the following issues :

Security issues fixed :

CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4392, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4345, CVE-2018-4372, CVE-2018-4373, CVE-2018-4375, CVE-2018-4376, CVE-2018-4416, CVE-2018-4378, CVE-2018-4382, CVE-2018-4386 (bsc#1110279, bsc#1116998). This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for webkit2gtk3 to version 2.22.5 fixes the following issues :

Security issues fixed :

CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4373, CVE-2018-4162, CVE-2018-4163, CVE-2018-4165, CVE-2018-11713, CVE-2018-4207, CVE-2018-4208, CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213, CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for webkit2gtk3 to version 2.22.4 fixes the following issues :

Security issues fixed :

CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4392, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4345, CVE-2018-4372, CVE-2018-4373, CVE-2018-4375, CVE-2018-4376, CVE-2018-4416, CVE-2018-4378, CVE-2018-4382, CVE-2018-4386 (bsc#1110279, bsc#1116998).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses the following vulnerability :

  -     [CVE-2018-4345](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2018-4345)

This update brings the following changes :

  - Many improvements and fixes for video playback with     media source extensions (MSE), which improve the user     experience across the board, and in particular for     playback of WebM videos.

  - Fix a memory leak during media playback when using     playbin3.

  - Fix portions of Web views not being rendered after     resizing.

  - Fix Resource Timing reporting for iframe elements.

  - Fix the build with the remote Web Inspector disabled.

  - Fix the build on ARMv7 with NEON extensions.

  - Fix several crashes and rendering issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iTunes installed on the remote Windows host is prior to 12.9. It is, therefore, affected by multiple vulnerabilities as referenced in the HT209140 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.9. It is, therefore, affected by multiple vulnerabilities in WebKit as referenced in the HT209140 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
700552	Apple iOS < 12.0 Multiple Vulnerabilities (EFAIL, APPLE-SA-2018-9-24-4 and APPLE-SA-2018-10-30-8)	Nessus Network Monitor	Mobile Devices	medium
700505	Apple Safari < 12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
121339	openSUSE Security Update : webkit2gtk3 (openSUSE-2019-81)	Nessus	SuSE Local Security Checks	medium
121291	openSUSE Security Update : webkit2gtk3 (openSUSE-2019-68)	Nessus	SuSE Local Security Checks	medium
121206	SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:0092-1)	Nessus	SuSE Local Security Checks	medium
121093	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2019:0059-1)	Nessus	SuSE Local Security Checks	medium
120664	Fedora 29 : webkit2gtk3 (2018-a1f37d2f08)	Nessus	Fedora Local Security Checks	medium
120420	Fedora 28 : webkit2gtk3 (2018-509fc4a5c8)	Nessus	Fedora Local Security Checks	medium
119255	Ubuntu 18.04 LTS / 18.10 : webkit2gtk vulnerabilities (USN-3828-1)	Nessus	Ubuntu Local Security Checks	medium
117880	Apple iTunes < 12.9 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
117879	Apple iTunes < 12.9 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
117632	Apple iOS < 12.0 Multiple Vulnerabilities (EFAIL)	Nessus	Mobile Devices	medium
117617	macOS : Apple Safari < 12 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

CVE-2018-4345

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins