The version of webkitgtk4 installed on the remote host is prior to 2.46.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2869 advisory.

    The issue was addressed with improved UI handling. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4,     visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, Safari 17.4. A malicious website may exfiltrate     audio data cross-origin. (CVE-2024-23254)

    A logic issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, Safari     17.3, tvOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A malicious website may cause unexpected cross-origin     behavior. (CVE-2024-23271)

    The issue was addressed with improved memory handling. This issue is fixed in tvOS 17.5, visionOS 1.2,     Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing web content may lead to     arbitrary code execution. (CVE-2024-27808)

    The issue was addressed with improved memory handling. This issue is fixed in tvOS 17.5, iOS 16.7.8 and     iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5.
    Processing web content may lead to arbitrary code execution. (CVE-2024-27820)

    This issue was addressed through improved state management. This issue is fixed in tvOS 17.5, visionOS     1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A maliciously crafted webpage     may be able to fingerprint the user. (CVE-2024-27830)

    An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 17.5, iOS     16.7.8 and iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2024-27833)

    The issue was addressed by adding additional logic. This issue is fixed in tvOS 17.5, iOS 16.7.8 and     iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A     maliciously crafted webpage may be able to fingerprint the user. (CVE-2024-27838)

    This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in     visionOS 1.2, macOS Sonoma 14.5, Safari 17.5, iOS 17.5 and iPadOS 17.5. A maliciously crafted webpage may     be able to fingerprint the user. (CVE-2024-27850)

    The issue was addressed with improved bounds checks. This issue is fixed in tvOS 17.5, visionOS 1.2,     Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2024-27851)

    The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, iOS 16.7.8 and     iPadOS 16.7.8, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, tvOS 17.5, visionOS 1.2. Processing a     file may lead to unexpected app termination or arbitrary code execution. (CVE-2024-27856)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.7.9     and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS     Sonoma 14.6. Processing maliciously crafted web content may lead to an unexpected process crash.
    (CVE-2024-40782)

    This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2,     watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content     may lead to universal cross site scripting. (CVE-2024-40857)

    The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a     malicious website may lead to address bar spoofing. (CVE-2024-40866)

    The issue was addressed with improved checks. This issue is fixed in tvOS 17.6, visionOS 1.3, Safari 17.6,     watchOS 10.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Processing maliciously crafted web content may     lead to an unexpected process crash. (CVE-2024-44185)

    A cross-origin issue existed with iframe elements. This was addressed with improved tracking of security     origins. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18,     tvOS 18. A malicious website may exfiltrate data cross-origin. (CVE-2024-44187)

    The issue was addressed with improved checks. This issue is fixed in watchOS 11, macOS Sequoia 15, Safari     18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to an     unexpected process crash. (CVE-2024-44192)

    A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 18.1     and iPadOS 18.1, watchOS 11.1, visionOS 2.1, tvOS 18.1, macOS Sequoia 15.1, Safari 18.1. Processing     maliciously crafted web content may lead to an unexpected process crash. (CVE-2024-44244)

    The issue was addressed with improved checks. This issue is fixed in tvOS 18.1, iOS 18.1 and iPadOS 18.1,     iOS 17.7.1 and iPadOS 17.7.1, watchOS 11.1, visionOS 2.1, macOS Sequoia 15.1, Safari 18.1. Processing     maliciously crafted web content may prevent Content Security Policy from being enforced. (CVE-2024-44296)

    A cookie management issue was addressed with improved state management. This issue is fixed in Safari     18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1.
    Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a     report that this issue may have been actively exploited on Intel-based Mac systems. (CVE-2024-44309)

    The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS     2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted     web content may lead to an unexpected process crash. (CVE-2024-54479)

    The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS     18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web     content may lead to an unexpected process crash. (CVE-2024-54502)

    A type confusion issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3,     watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2.
    Processing maliciously crafted web content may lead to memory corruption. (CVE-2024-54505)

    The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2,     tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web     content may lead to an unexpected process crash. (CVE-2024-54508)

    The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2,     tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web     content may lead to memory corruption. (CVE-2024-54534)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.2, tvOS 18.2,     Safari 18.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. Processing maliciously crafted     web content may lead to memory corruption. (CVE-2024-54543)

    The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.6, tvOS 17.6,     Safari 17.6, macOS Sonoma 14.6, visionOS 1.3, iOS 17.6 and iPadOS 17.6. Processing web content may lead to     a denial-of-service. (CVE-2024-54551)

    The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4,     Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, macOS Sonoma 14.4. Processing web content may lead to     a denial-of-service. (CVE-2024-54658)

    The issue was addressed with improved access restrictions to the file system. This issue is fixed in macOS     Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. A maliciously crafted webpage may be     able to fingerprint the user. (CVE-2025-24143)

    A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sequoia 15.3,     Safari 18.3, iOS 18.3 and iPadOS 18.3. Copying a URL from Web Inspector may lead to command injection.
    (CVE-2025-24150)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, Safari 18.3,     iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing web content may lead to     a denial-of-service. (CVE-2025-24158)

    This issue was addressed through improved state management. This issue is fixed in visionOS 2.3, Safari     18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously     crafted web content may lead to an unexpected process crash. (CVE-2025-24162)

    An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This     issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1.
    Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary     fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been     exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS     before iOS 17.2.). (CVE-2025-24201)

    A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS     18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.
    (CVE-2025-24208)

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 18.4,     Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted     web content may lead to an unexpected process crash. (CVE-2025-24209)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4,     iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted     web content may lead to an unexpected Safari crash. (CVE-2025-24216)

    The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4,     iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted     web content may lead to an unexpected Safari crash. (CVE-2025-24264)

    A use-after-free issue was addressed with improved memory management. This issue is fixed in visionOS 2.4,     tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing     maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2025-30427)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : webkitgtk4 (ALAS-2025-2869)

critical Nessus Plugin ID 237469

Version 1.1