The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02973-1 advisory.

    - Update to version 2.48.5:
      - CVE-2025-31273: Fixed processing maliciously crafted web content leading to memory corruption     (bsc#1247564)
      - CVE-2025-43265: Fixed processing maliciously crafted web content disclosing internal states of the app     (bsc#1247600)
      - CVE-2025-43216: Fixed processing maliciously crafted web content leading to an unexpected Safari crash     (bsc#1247596)
      - CVE-2025-31278: Fixed processing maliciously crafted web content leading to memory corruption     (bsc#1247563)
      - CVE-2025-6558: Fixed processing maliciously crafted web content leading to an unexpected Safari crash.
    (bsc#1247742)
      - CVE-2025-43227: Fixed Processing maliciously crafted web content disclosing sensitive user information     (bsc#1247597)
      - CVE-2025-43240: Fixed downloads origin incorrectly associated (bsc#1247599)
      - CVE-2025-43228: Fixed visiting a malicious website leading to address bar spoofing (bsc#1247598)
      - CVE-2025-43212: Fixed processing maliciously crafted web content leading to an unexpected Safari crash     (bsc#1247595)
      - CVE-2025-43211: Fixed processing web content leading to a denial-of-service (bsc#1247562)
      - Fix several crashes.
      - Changes in version 2.48.4:
      - Improve emoji font selection with USE_SKIA=ON.
      - Improve playback of multimedia streams from blob URLs.
      - Fix the build with USE_SKIA_OPENTYPE_SVG=ON and         USE_SYSPROF_CAPTURE=ON.
      - Fix the build on LoongArch with USE_SKIA=ON.
      - Fix crash when using a WebKitWebView widget in an offscreen         window.
      - Fix several crashes and rendering issues.
      - Changes in version 2.48.3:
      - Fix a crash introduced by the new threaded rendering         implementation using Skia API.
      - Improve rendering performance by recording layers once and         replaying every dirty region in different worker threads.
      - Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0.
      - Fix a reference cycle in webkitmediastreamsrc preventing its         disposal.

    - CVE-2024-44192:Fixed processing maliciously crafted web content leading to an unexpected process crash     (bsc#1239863)
    - CVE-2024-54467: Fixed data cross-origin exfiltration due to a cookie management issue (bsc#1239864)
    - CVE-2025-24201: Fixed out-of-bounds write vulnerability (bsc#1239547)
    - CVE-2025-24189: Fixed processing maliciously crafted web content leading to memory corruption     (bsc#1247565)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2025:02973-1)

critical Nessus Plugin ID 255211

Version 1.2

Version 1.1

Version 1.2 Jun 27, 2026, 1:18 PM CVSS metrics ("CVSSv3 score" set to 10.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H") Plugin metadata Plugin Feed: 202606271318
Version 1.1 Aug 26, 2025, 5:34 PM New Plugin Feed: 202508261734