远程主机上正在运行的 macOS / Mac OS X 版本为低于 10.14.6 安全更新 2021-001 Mojave 的 10.14.x、低于 10.15.7 安全更新 2021-001 的 10.15.x，或低于 11.2 的 11.x。因此，该应用程序受到多个漏洞的影响，其中包括：

  - 存在一个逻辑问题，可导致内存损坏。已通过改进状态管理解决此问题。
    应用程序可能以内核权限执行任意代码。(CVE-2020-27904)

  - 存在一个逻辑问题，允许应用程序以内核权限执行任意代码。
    (CVE-2021-1750)

  - 由不当输入验证导致的越界写入问题，允许恶意构建的 USD 文件意外终止应用程序或造成任意代码执行。(CVE-2021-1762)

请注意，Nessus 并未测试此问题，而是只依靠操作系统自我报告的版本号来判断。

远程主机受到 GLSA-202104-03 中所述漏洞的影响（WebkitGTK+：多个漏洞）

    已在 WebkitGTK+ 中发现多个漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    攻击者通过诱骗用户访问恶意构建的 Web 内容，或可执行任意代码，违反 iframe 沙盒策略，访问任意服务器上的受限端口，造成内存损坏，或可能造成拒绝服务情况。
  变通方案：

    目前无任何已知的变通方案。

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.6 Security Update 2021-001 Mojave, 10.15.x prior to 10.15.7 Security Update 2021-001 Catalina, or 11.x prior to 11.2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A logic issue existed resulting in memory corruption. This was addressed with improved state management.
    An application may be able to execute arbitrary code with kernel privileges. (CVE-2020-27904)

  - A logic issue existed that allowed applications to execute arbitrary code with kernel privileges.
    (CVE-2021-1750)

  - An out-of-bounds-write caused by improper input validation allowed maliciously crafted USD files to     unexpectedly terminate an application or cause arbitrary code execution. (CVE-2021-1762)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202104-03 (WebkitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebkitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker, by enticing a user to visit maliciously crafted web       content, may be able to execute arbitrary code, violate iframe sandboxing       policy, access restricted ports on arbitrary servers, cause memory       corruption, or could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for webkit2gtk3 fixes the following issues :

  - Update to version 2.32.0 (bsc#1184155) :

  - Fix the authentication request port when URL omits the     port.

  - Fix iframe scrolling when main frame is scrolled in     async

  - scrolling mode.

  - Stop using g_memdup.

  - Show a warning message when overriding signal handler     for

  - threading suspension.

  - Fix the build on RISC-V with GCC 11.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2021-1788, CVE-2021-1844,     CVE-2021-1871

  - Update in version 2.30.6 (bsc#1184262) :

  - Update user agent quirks again for Google Docs and     Google Drive.

  - Fix several crashes and rendering issues.

  - Security fixes: CVE-2020-27918, CVE-2020-29623,     CVE-2021-1765 CVE-2021-1789, CVE-2021-1799,     CVE-2021-1801, CVE-2021-1870.

  - Update _constraints for armv6/armv7 (bsc#1182719)

  - restore NPAPI plugin support which was removed in 2.32.0

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities:

  - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in     versions prior to 2.30.5. Processing maliciously crafted web content may lead to arbitrary code execution.
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-13558)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27918)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully     delete the browsing history under some circumstances. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-29623)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content     may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
    (CVE-2021-1765, CVE-2021-1801)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-1788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
146086	macOS 10.14.x < 10.14.6 安全更新 2021-001 / 10.15.x < 10.15.7 安全更新 2021-001 / macOS 11.x < 11.2 (HT212147)	Nessus	MacOS X Local Security Checks	2/3/2021	5/28/2024	critical
149222	GLSA-202104-03：WebkitGTK+：多个漏洞	Nessus	Gentoo Local Security Checks	5/3/2021	5/6/2022	critical
241427	RHEL 7：webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	7/7/2025	7/7/2025	critical
146086	macOS 10.14.x < 10.14.6 Security Update 2021-001 / 10.15.x < 10.15.7 Security Update 2021-001 / macOS 11.x < 11.2 (HT212147)	Nessus	MacOS X Local Security Checks	2/3/2021	5/28/2024	critical
149222	GLSA-202104-03 : WebkitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/3/2021	5/6/2022	critical
149570	openSUSE Security Update : webkit2gtk3 (openSUSE-2021-637)	Nessus	SuSE Local Security Checks	5/18/2021	4/25/2023	critical
206839	NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)	Nessus	NewStart CGSL Local Security Checks	9/10/2024	9/10/2024	critical
241427	RHEL 7 : webkitgtk4 (RHSA-2025:10364)	Nessus	Red Hat Local Security Checks	7/7/2025	7/7/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical