https://support.apple.com/en-us/HT213442

https://support.apple.com/en-us/HT213445

https://support.apple.com/en-us/HT213446

FEDORA-2022-0c00617967

FEDORA-2022-a77b646471

FEDORA-2022-ece798a8d4

DSA-5241

DSA-5240

[debian-lts-announce] 20220929 [SECURITY] [DLA 3124-1] webkit2gtk security update

20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13

The remote SUSE Linux SLED15 / SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3538-1 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

  - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3492-1 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

  - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3502-1 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

  - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3488-1 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

  - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3124 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5240 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5241 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5642-1 advisory.

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS     16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2022-32886)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 16. It is, therefore, affected by multiple vulnerabilities:

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32886)

  - An app may be able to disclose kernel memory (CVE-2022-32864)

  - An app may be able to execute arbitrary code with kernel privilege (CVE-2022-32911)    
  - An application may be able to execute arbitrary code with kernel privileges (CVE-2022-32917)

  - A user may be able to elevate privileges (CVE-2022-32908)

  - Visiting a malicious website may lead to address bar spoofing (CVE-2022-32795)

  - An app may be able to bypass Privacy preferences (CVE-2022-32854) 

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32912)

  - A website may be able to track users through Safari web extensions (CVE-2022-32868)

  - A person with physical access to an iOS device may be able to access photos from the lock screen (CVE-2022-32872)

  - An app may be able to read sensitive location information (CVE-2022-32883)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 15.7. It is, therefore, affected by multiple vulnerabilities:

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32886)

  - An app may be able to disclose kernel memory (CVE-2022-32864)

  - An app may be able to execute arbitrary code with kernel privilege (CVE-2022-32911)    
  - An application may be able to execute arbitrary code with kernel privileges (CVE-2022-32917)

  - A user may be able to elevate privileges (CVE-2022-32908)

  - Visiting a malicious website may lead to address bar spoofing (CVE-2022-32795)

  - An app may be able to bypass Privacy preferences (CVE-2022-32854) 

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32912)

  - A website may be able to track users through Safari web extensions (CVE-2022-32868)

  - A person with physical access to an iOS device may be able to access photos from the lock screen (CVE-2022-32872)

  - An app may be able to read sensitive location information (CVE-2022-32883)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165751	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : webkit2gtk3 (SUSE-SU-2022:3538-1)	Nessus	SuSE Local Security Checks	high
165688	SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2022:3492-1)	Nessus	SuSE Local Security Checks	high
165660	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2022:3502-1)	Nessus	SuSE Local Security Checks	high
165618	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : webkit2gtk3 (SUSE-SU-2022:3488-1)	Nessus	SuSE Local Security Checks	high
165550	Debian DLA-3124-1 : webkit2gtk - LTS security update	Nessus	Debian Local Security Checks	high
165549	Debian DSA-5240-1 : webkit2gtk - security update	Nessus	Debian Local Security Checks	high
165546	Debian DSA-5241-1 : wpewebkit - security update	Nessus	Debian Local Security Checks	high
165466	Ubuntu 20.04 LTS / 22.04 LTS : WebKitGTK vulnerabilities (USN-5642-1)	Nessus	Ubuntu Local Security Checks	high
165105	Apple iOS < 16 Multiple Vulnerabilities (HT213446)	Nessus	Mobile Devices	high
164970	Apple iOS < 15.7 Multiple Vulnerabilities (HT213445)	Nessus	Mobile Devices	high

CVE-2022-32886

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high