The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6535 advisory.

  - webkitgtk: Memory corruption issue when processing web content (CVE-2022-32885)

  - webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing. (CVE-2022-32919)

  - webkitgtk: A website may able to track visited websites in private browsing (CVE-2022-32933)

  - webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2022-46705)

  - webkitgtk: Visiting a malicious website may lead to address bar spoofing. (CVE-2022-46725)

  - webkitgtk: Same Origin Policy bypass via crafted web content (CVE-2023-27932)

  - webkitgtk: Website may be able to track sensitive user information (CVE-2023-27954)

  - webkitgtk: use after free vulnerability (CVE-2023-28198)

  - webkitgtk: content security policy blacklist failure (CVE-2023-32370)

  - webkitgtk: arbitrary code execution (CVE-2023-32393, CVE-2023-38594, CVE-2023-38595, CVE-2023-38597,     CVE-2023-38600, CVE-2023-38611)

  - webkitgtk: disclose sensitive information (CVE-2023-38133)

  - webkitgtk: bypass Same Origin Policy (CVE-2023-38572)

  - webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2023-38592, CVE-2023-42833)

  - webkitgtk: track sensitive user information (CVE-2023-38599)

  - webkitgtk: processing web content may lead to arbitrary code execution (CVE-2023-39434)

  - webkitgtk: arbitrary javascript code execution (CVE-2023-40397)

  - webkitgtk: attacker with JavaScript execution may be able to execute arbitrary code (CVE-2023-40451)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 9 : webkit2gtk3 (RHSA-2023:6535)

critical Nessus Plugin ID 185146

Version 1.1

Version 1.0

Version 1.1 Apr 28, 2024, 2:25 PM CVE (set "CVE" coverage to "CVE-2022-32885,CVE-2022-32919,CVE-2022-32933,CVE-2022-46705,CVE-2022-46725,CVE-2023-27932,CVE-2023-27954,CVE-2023-28198,CVE-2023-32370,CVE-2023-32393,CVE-2023-38133,CVE-2023-38572,CVE-2023-38592,CVE-2023-38594,CVE-2023-38595,CVE-2023-38597,CVE-2023-38599,CVE-2023-38600,CVE-2023-38611,CVE-2023-39434,CVE-2023-40397,CVE-2023-40451,CVE-2023-42833") CVSSv2 score source (changed from "CVE-2023-40451" to "CVE-2023-42833") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.0 Nov 7, 2023, 5:17 PM New Plugin Feed: 202311071717