The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities:

  - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in     versions prior to 2.30.5. Processing maliciously crafted web content may lead to arbitrary code execution.
    The highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-13558)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27918)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. A user may be unable to fully     delete the browsing history under some circumstances. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-29623)

  - A flaw was found in WebKitGTK and WPE WebKit in versions prior to 2.30.6. Maliciously crafted web content     may violate the iframe sandboxing policy. The highest threat from this vulnerability is to data integrity.
    (CVE-2021-1765, CVE-2021-1801)

  - A use-after-free issue was found in WebKitGTK and WPE WebKit in versions prior to 2.32.0. Processing     maliciously crafted web content may lead to arbitrary code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-1788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1777 advisory.

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)

    * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)

    * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)

    * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)

    * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)

    * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)

    * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)

    * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)

    * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)

    * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)

    * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)

    * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)

    * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)

    * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)

    * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)

    * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)

    * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.2 Monterey. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A memory corruption issue in IOMobileFrameBuffer that can lead to arbitrary code execution with kernel     privileges due to improper input validation. (CVE-2022-22587)

  - A buffer overflow issue in the kernel that can lead to arbitrary code execution with kernel privileges     due to improper memory handling. (CVE-2022-22593)

  - An information disclosure issue in Model I/O that can lead to unexpected application termination or     arbitrary code execution due to improper state management. (CVE-2022-22579)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 15.3. It is, therefore, affected by multiple vulnerabilities.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1777 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.34.6). (BZ#1985042)

    Security Fix(es):

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)

    * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)

    * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)

    * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)

    * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)

    * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)

    * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)

    * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)

    * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)

    * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)

    * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)

    * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)

    * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)

    * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)

    * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)

    * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)

    * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1777 advisory.

  - A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15,     tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2021-30809)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2021-30818)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be     able to bypass HSTS. (CVE-2021-30823)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and     iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may     disclose restricted memory. (CVE-2021-30836)

  - The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15,     watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing     history. (CVE-2021-30884)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS     15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     unexpectedly unenforced Content Security Policy. (CVE-2021-30887)

  - An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS     Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content     Security Policy reports may be able to leak information via redirect behavior . (CVE-2021-30888)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey     12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30889)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1,     iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to     universal cross site scripting. (CVE-2021-30890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3625:01 advisory.

    * webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free     (CVE-2022-22620)
      * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30809)
      * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-30818)
      * webkitgtk: Logic issue leading to HSTS bypass (CVE-2021-30823)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30846)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30848)
      * webkitgtk: Multiple memory corruption issue leading to arbitrary code execution (CVE-2021-30849)
      * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-30851)
      * webkitgtk: Logic issue leading to Content Security Policy bypass (CVE-2021-30887)
      * webkitgtk: Information leak via Content Security Policy reports (CVE-2021-30888)
      * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2021-30889)
      * webkitgtk: Logic issue leading to universal cross-site scripting (CVE-2021-30890)
      * webkitgtk: Cross-origin data exfiltration via resource timing API (CVE-2021-30897)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30934)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30936)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30951)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30952)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30953)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30954)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2021-30984)
      * webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create     (CVE-2021-45481)
      * webkitgtk: use-after-free in WebCore::ContainerNode::firstChild (CVE-2021-45482)
      * webkitgtk: use-after-free in WebCore::Frame::page (CVE-2021-45483)
      * webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript     (CVE-2022-22589)
      * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-22590)
      * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being     enforced (CVE-2022-22592)
      * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2022-22594)
      * webkitgtk: logic issue was addressed with improved state management (CVE-2022-22637)
      * webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2021-30836)
      * webkitgtk: CSS compositing issue leading to revealing of the browsing history (CVE-2021-30884)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1511-1 advisory.

    Update to version 2.36.0 (bsc#1198290):

    - CVE-2022-22624: Fixed use after free that may lead to arbitrary code execution.
    - CVE-2022-22628: Fixed use after free that may lead to arbitrary code execution.
    - CVE-2022-22629: Fixed a buffer overflow that may lead to arbitrary code execution.
    - CVE-2022-22637: Fixed an unexpected cross-origin behavior due to a logic error.

    Missing CVE reference for the update to 2.34.6 (bsc#1196133):

    - CVE-2022-22594: Fixed a cross-origin issue in the IndexDB API.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
206839	NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)	Nessus	NewStart CGSL Local Security Checks	9/10/2024	3/7/2026	critical
358031	Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2022_1777)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
157403	macOS 12.x < 12.2 (HT213054)	Nessus	MacOS X Local Security Checks	2/7/2022	5/28/2024	critical
276044	TencentOS Server 2: webkitgtk4 (TSSA-2025:0554)	Nessus	Tencent Local Security Checks	11/20/2025	11/5/2026	critical
157199	Apple iOS < 15.3 Multiple Vulnerabilities (HT213053)	Nessus	Mobile Devices	1/28/2022	11/9/2026	critical
161003	RHEL 8 : webkit2gtk3 (RHSA-2022:1777)	Nessus	Red Hat Local Security Checks	5/11/2022	3/7/2026	high
161341	Rocky Linux 8 : webkit2gtk3 (RLSA-2022:1777)	Nessus	Rocky Linux Local Security Checks	5/18/2022	3/7/2026	high
293462	MiracleLinux 8 : webkit2gtk3-2.34.6-1.el8.ML.1 (AXSA:2022-3625:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	3/7/2026	high
160490	SUSE SLES15: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:1511-1)	Nessus	SuSE Local Security Checks	5/4/2022	6/26/2026	high

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

high

high

high

high