The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4035 advisory.

    [2.28.2-2]
    - Resolves: rhbz#1817144 Rebuild to support ppc and s390

    [2.28.2-1]
    - Resolves: rhbz#1817144 Rebase to 2.28.2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.10.4. It is, therefore, affected by multiple vulnerabilities as referenced in the HT210923 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4451 advisory.

  - webkitgtk: Incorrect state management leading to universal cross-site scripting (CVE-2019-8625,     CVE-2019-8813, CVE-2020-3867)

  - webkitgtk: Multiple memory corruption issues leading to arbitrary code execution (CVE-2019-8710,     CVE-2019-8720, CVE-2019-8766, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812,     CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2020-3868)

  - webkitgtk: Multiple memory corruption  issues leading to arbitrary code execution (CVE-2019-8743)

  - webkitgtk: Incorrect state  management leading to universal cross-site scripting (CVE-2019-8764)

  - webkitgtk: Websites could reveal browsing history (CVE-2019-8769)

  - webkitgtk: Violation of iframe sandboxing policy (CVE-2019-8771)

  - webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2019-8835,     CVE-2019-8844)

  - webkitgtk: Use after free issue may lead to remote code execution (CVE-2019-8846)

  - webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp (CVE-2020-10018)

  - webkitgtk: use-after-free via crafted web content (CVE-2020-11793)

  - gnome-settings-daemon: Red Hat Customer Portal password logged and passed as command line argument when     user registers through GNOME control center (CVE-2020-14391)

  - LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)

  - webkitgtk: Denial of service via incorrect memory handling (CVE-2020-3862)

  - webkitgtk: Non-unique security origin for DOM object contexts (CVE-2020-3864)

  - webkitgtk: Incorrect security check for a top-level DOM object context (CVE-2020-3865)

  - webkitgtk: Incorrect processing of file URLs (CVE-2020-3885)

  - webkitgtk: Race condition allows reading of restricted memory (CVE-2020-3894)

  - webkitgtk: Memory corruption triggered by a malicious web content (CVE-2020-3895)

  - webkitgtk: Type confusion leading to arbitrary code execution (CVE-2020-3897, CVE-2020-3901)

  - webkitgtk: Memory consumption issue leading to arbitrary code execution (CVE-2020-3899)

  - webkitgtk: Memory corruption  triggered by a malicious web content (CVE-2020-3900)

  - webkitgtk: Input validation issue leading to cross-site script attack (CVE-2020-3902)

  - webkitgtk: Logic issue may lead to arbitrary code execution (CVE-2020-9802, CVE-2020-9850)

  - webkitgtk: Memory corruption may lead to arbitrary code execution (CVE-2020-9803, CVE-2020-9806,     CVE-2020-9807)

  - webkitgtk: Logic issue may lead to cross site scripting (CVE-2020-9805)

  - webkitgtk: Input validation issue may lead to cross site scripting (CVE-2020-9843)

  - webkitgtk: Command injection in web inspector (CVE-2020-9862)

  - webkitgtk: Use-after-free may lead to application termination or arbitrary code execution (CVE-2020-9893,     CVE-2020-9895)

  - webkitgtk: Out-of-bounds read may lead to unexpected application termination or arbitrary code execution     (CVE-2020-9894)

  - webkitgtk: Access issue in content security policy (CVE-2020-9915)

  - webkitgtk: A logic issue may lead to cross site scripting (CVE-2020-9925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
141259	Oracle Linux 7 : webkitgtk4 (ELSA-2020-4035)	Nessus	Oracle Linux Local Security Checks	10/7/2020	11/1/2024	critical
134222	Apple iTunes < 12.10.4 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	3/5/2020	10/12/2026	high
134221	Apple iTunes < 12.10.4 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	3/5/2020	10/12/2026	high
145826	CentOS 8 : GNOME (CESA-2020:4451)	Nessus	CentOS Local Security Checks	2/1/2021	5/25/2022	critical

Detections

Analytics

Plugins Search

critical

high

high

critical