远程 Windows 主机上安装的 Apple iTunes 版本低于 12.3。因此，它受到 WebKit、CoreText、Microsoft Visual Studio C++ Redistributable Package 和 ICU 的捆绑版本中的多种漏洞的影响。

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

远程主机上运行的 Apple iTunes 版本低于 12.3。因此，它受到 WebKit、CoreText 和 ICU 组件中以及 Microsoft Visual Studio C++ Redistributable Package 的捆绑版本中多种漏洞的影响。攻击者可利用这些漏洞造成拒绝服务、执行任意代码或者获取已加密 SMB 凭据的访问权限。

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

遠端 Mac OS X 主機上安裝的 Apple Safari 版本比 6.2.8 / 7.1.8 / 8.0.8 舊。因此，該應用程式受到以下弱點影響：

  - 存在一個不明瑕疵，會讓攻擊者得以利用特製網頁來偽造 UI 元素。
    (CVE-2015-3729)

  - WebKit 中存有多個記憶體損毀瑕疵，這是因為不當驗證使用者提供的輸入所致。攻擊者可惡意利用這些瑕疵，使用特製網頁來執行任意程式碼。(CVE-2015-3730、CVE-2015-3731 CVE-2015-3732、CVE-2015-3733、CVE-2015-3734、CVE-2015-3735、CVE-2015-3736、CVE-2015-3737、CVE-2015-3738、CVE-2015-3739、CVE-2015-3740、CVE-2015-3741、CVE-2015-3742、CVE-2015-3743、CVE-2015-3744、CVE-2015-3745、CVE-2015-3746、CVE-2015-3747、CVE-2015-3748、CVE-2015-3749)

  - WebKit 中存有一個安全性原則繞過弱點，這與內容安全性原則報告要求的處理有關。攻擊者可利用此弱點繞過 HTTP Strict Transport Security 原則。(CVE-2015-3750)

  - WebKit 中存有一個安全性原則繞過弱點，允許網站違反內容安全性原則指示詞，使用視訊控制項來載入物件元素中巢狀的影像。(CVE-2015-3751)

  - WebKit 中存有一個資訊洩漏弱點，這與 cookie 新增至內容安全性原則報告要求的方式有關，會導致 cookie 被洩漏至跨來源要求。此外，正常瀏覽期間設定的 cookie 會在私密瀏覽時被傳送出去。(CVE-2015-3752)

  - WebKit Canvas 元件中存有一個資訊洩漏弱點，當使用重新導向至 data:image 資源的 URL 來呼叫影像時，就會觸發此弱點。攻擊者可利用此弱點，透過惡意網站洩漏跨來源的影像資料。(CVE-2015-3753)

  - WebKit 頁面載入中存在一個資訊洩漏弱點，在私密瀏覽模式下輸入的 HTTP 驗證認證在快取時會被傳遞至正常瀏覽，從而導致使用者的私密瀏覽歷程記錄遭洩漏。(CVE-2015-3754)

  - WebKit 處理程序模型中有一個瑕疵，允許惡意網站顯示任意 URL，進而導致使用者介面偽造。(CVE-2015-3755)

在 WebKitGTK+ Web 和 JavaScript 引擎中發現大量安全性問題。如果使用者遭到誘騙而檢視惡意網站，遠端攻擊者可利用多個與網頁瀏覽器安全性相關的問題，包括跨網站指令碼攻擊、拒絕服務攻擊和任意程式碼執行等。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

此更新可解決下列弱點：

- CVE-2015-1120

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1120)

- CVE-2015-1076

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1076)

- CVE-2015-1071

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1071)

- CVE-2015-1081

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1081)

- CVE-2015-1122

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1122)

- CVE-2015-1155

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1155)

- CVE-2014-1748

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1748)

- CVE-2015-3752

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3752)

- CVE-2015-5809

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5809)

- CVE-2015-5928

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5928)

- CVE-2015-3749

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3749)

- CVE-2015-3659

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3659)

- CVE-2015-3748

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3748)

- CVE-2015-3743

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3743)

- CVE-2015-3731

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3731)

- CVE-2015-3745

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3745)

- CVE-2015-5822

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5822)

- CVE-2015-3658

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3658)

- CVE-2015-3741

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3741)

- CVE-2015-3727

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3727)

- CVE-2015-5801

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5801)

- CVE-2015-5788

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5788)

- CVE-2015-3747

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3747)

- CVE-2015-5794

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5794)

- CVE-2015-1127

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1127)

- CVE-2015-1153

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1153)

- CVE-2015-1083

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1083)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

行動裝置執行的 iOS 版本比 8.4.1 舊。
因此受到下列元件中的弱點影響：

  - Air Traffic
  - AppleFileConduit
  - 備份
  - bootp
  - CFPreferences
  - Certificate UI
  - CloudKit
  - 程式碼簽署
  - CoreMedia Playback
  - CoreText
  - DiskImages
  - FontParser
  - IOHIDFamily
  - IOKit
  - ImageIO
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - Location Framework
  - MSVDX 驅動程式
  - MobileInstallation
  - Office Viewer
  - QL Office
  - Safari
  - Sandbox_profiles
  - UIKit View
  - Web
  - WebKit

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - WebKit如在 8.4.1 之前的 Apple iOS 以及 6.2.8之前的 Safari、 7.x 之前的 7.1.8和 8.x 之前的 8.0.8中所使用允許遠端攻擊者執行任意程式碼或造成拒絕服務 (記憶體損毀和應用程式損毀)透過特製網站此弱點與 APPLE-SA-2015-08-13-1 和 APPLE-SA-2015-08-13-3 中列出的其他 WebKit CVE 不同。 (CVE-2015-3749)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

遠端 Windows 主機上安裝的 Apple iTunes 版本比 12.3 舊。因此受到 WebKit 的隨附版本、CoreText、Microsoft Visual Studio C++ Redistributable Package 與 ICU 中的多個弱點影響。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端主機上安裝的 Apple iTunes 版本比 12.3 舊。因此會受到 WebKit、CoreText 和 ICU 元件及隨附版 Microsoft Visual Studio C++ Redistributable Package 中的多個弱點影響。攻擊者可惡意利用這些弱點，造成拒絕服務、執行任意程式碼或取得加密 SMB 認證的存取權。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

Versions of Safari prior to 6.2.8 / 7.1.8 / 8.0.8 are reportedly affected by the following vulnerabilities :

 - An unspecified flaw exists that allows an attacker to spoof UI elements by using crafted web pages. (CVE-2015-3729)
 - Multiple memory corruption flaws exist in WebKit due to improper validation of user-supplied input. An attacker can exploit these, by using a crafted web page, to execute arbitrary code. (CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749)
 - A security policy bypass vulnerability exists in WebKit related to handling Content Security Policy report requests. An attacker can exploit this to bypass the HTTP Strict Transport Security policy. (CVE-2015-3750)
 - A security policy bypass vulnerability exists in WebKit that allows websites to use video controls to load images nested in object elements in violation of Content Security Policy directives. (CVE-2015-3751)
 - An information disclosure vulnerability exists in WebKit related to how cookies are added to Content Security Policy report requests, which results in cookies being exposed to cross-origin requests. Also, cookies set during regular browsing are sent during private browsing. (CVE-2015-3752)
 - An information disclosure vulnerability exists in the WebKit Canvas component when images are called using URLs that redirect to a data:image resource. An attacker, using a malicious website, can exploit this to disclose image data cross-origin. (CVE-2015-3753)
 - An information disclosure vulnerability exists in WebKit page loading where the caching of HTTP authentication credentials entered in private browsing mode were carried over into regular browsing, resulting in a user's private browsing history being exposed. (CVE-2015-3754)
 - A flaw in the WebKit process model allows a malicious website to display an arbitrary URL, which can allow user interface spoofing. (CVE-2015-3755)

The remote host is running a version of iOS that is prior to version 8.4.1 and the following components contain vulnerabilities :

 - Air Traffic 
 - AppleFileConduit 
 - Backup 
 - bootp 
 - CFPreferences 
 - Certificate UI 
 - CloudKit 
 - Code Signing 
 - CoreMedia Playback 
 - CoreText 
 - DiskImages 
 - FontParser 
 - IOHIDFamily 
 - IOKit 
 - ImageIO 
 - Kernel 
 - Libc 
 - Libinfo 
 - libpthread 
 - libxml2 
 - libxpc 
 - Location Framework 
 - MSVDX Driver 
 - MobileInstallation 
 - Office Viewer 
 - QL Office 
 - Safari 
 - Sandbox_profiles 
 - UIKit WebView 
 - Web 
 - WebKit 


Versions of Apple TV earlier than 7.2.1 are unpatched for vulnerabilities in the following components :

 - bootp
 - CFPreferences
 - CloudKit
 - Code Signing
 - CoreMedia Playback
 - CoreText
 - DiskImages
 - FontParser
 - ImageIO
 - IOHIDFamily
 - IOKit
 - Kernel
 - Libc
 - Libinfo
 - libpthread
 - libxml2
 - libxpc
 - libxslt
 - Location Framework
 - Office Viewer
 - QL Office
 - Sandbox_profiles
 - WebKit

Versions of iTunes earlier than 12.3 are affected by multiple vulnerabilities which include :

 - A flaw exists in Microsoft Foundation Class's handling of library loading due to the use of a fixed path.  An attacker can place a custom version of the file or library in the path, and the program will load it before the legitimate version.  Thus, an attacker can leverage this flaw to execute custom code. (CVE-2010-3190)
 - International Components for Unicode for C/C++ (ICU4C) contains several flaws.  An overflow condition exists in the resolveImplicitLevels() function in 'ubidi.c', which is triggered as user-supplied input is not properly validated. Additionally, an integer truncation flaw exists in the same function in 'ubidi.c'.   Either flaw may allow an attacker to crash an application linked against the library or potentially execute arbitrary code. (CVE-2014-8146, CVE-2014-8147, CVE-2015-5922)
 - A flaw exists in CoreText that is triggered as user-supplied input is not properly validated when handling text and font files. This may allow a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2015-1157, CVE-2015-5874, CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, CVE-2015-5755, CVE-2015-5761)
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-1152, CVE-2015-1153, CVE-2015-3730, CVE-2015-3731, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5796, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5808, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5821, CVE-2015-5822, CVE-2015-5823)
 - An unspecified flaw exists that is triggered during the handling of network connection redirects. This may allow a remote man-in-the-middle attacker to gain access to hashed SMB credential information. (CVE-2015-5920)

ID	Name	Product	Family	Published	Updated	Severity
86001	Apple iTunes < 12.3 多种漏洞（凭据检查）	Nessus	Windows	9/18/2015	11/22/2019	high
86601	Apple iTunes < 12.3 多种漏洞（无凭据检查）	Nessus	Peer-To-Peer File Sharing	10/26/2015	11/20/2019	high
85446	Mac OS X：Apple Safari < 6.2.8 / 7.1.8 / 8.0.8 多個弱點	Nessus	MacOS X Local Security Checks	8/17/2015	7/14/2018	medium
90094	Ubuntu 14.04 LTS：WebKitGTK+ 弱點 (USN-2937-1)	Nessus	Ubuntu Local Security Checks	3/22/2016	8/27/2024	high
90220	Fedora 24：webkitgtk-2.4.10-1.fc24 (2016-a4fcb02d6b)	Nessus	Fedora Local Security Checks	3/28/2016	1/11/2021	medium
85407	Apple iOS < 8.4.1 多個弱點	Nessus	Mobile Devices	8/14/2015	11/3/2025	high
263710	Linux Distros 未修補的弱點：CVE-2015-3749	Nessus	Misc.	9/10/2025	9/10/2025	high
90232	Fedora 24：webkitgtk3-2.4.10-1.fc24 (2016-fde7ffcb77)	Nessus	Fedora Local Security Checks	3/28/2016	1/11/2021	medium
86001	Apple iTunes < 12.3 多個弱點 (經認證的檢查)	Nessus	Windows	9/18/2015	11/22/2019	high
86601	Apple iTunes < 12.3 多個弱點 (未經認證的檢查)	Nessus	Peer-To-Peer File Sharing	10/26/2015	11/20/2019	high
8949	Safari < 6.2.8 / 7.1.8 / 8.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	10/1/2015	3/6/2019	high
8978	Apple iOS < 8.4.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	10/14/2015	3/6/2019	critical
9333	Apple TV < 7.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	5/27/2016	3/6/2019	low
8958	iTunes for Windows < 12.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	10/23/2015	3/6/2019	high

Detections

Analytics

Plugins Search

high

high

medium

high

medium

high

high

medium

high

high

high

critical

low

high