The version of Safari installed on the remote host is prior or equal to 9.1.1, and is affected by multiple vulnerabilities. These vulnerabilities are contained within the Webkit subcomponent.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote
    attackers to bypass the Same Origin Policy via a crafted web site. (CVE-2016-4590)

  - WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location
    variable, which allows remote attackers to access the local filesystem via unspecified vectors.
    (CVE-2016-4591)

  - WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to
    execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a
    different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624. (CVE-2016-4622)

  - WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to
    execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a
    different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4623. (CVE-2016-4624)

This update addresses the following vulnerabilities :

  -     [CVE-2016-4622](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-4622),     [CVE-2016-4624](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-4624),     [CVE-2016-4591](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-4591),     [CVE-2016-4590](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-4590)

Additional fixes :

  - Fix performance in accelerated compositing mode with the     modesetting intel driver and DRI3 enabled.

  - Reduce the amount of file descriptors that the Web     Process keeps open.

  - Fix Web Process deadlocks when loading HLS videos.

  - Make CSS and SVG animations run at 60fps.

  - Make meter elements accessible.

  - Improve accessibility name and description of elements     to make it more compatible with W3C specs and fix     several bugs in which the accessible name of objects was     missing or broken.

  - Fix a crash when running windowed plugins under Wayland.

  - Fix a crash at process exit under Wayland.

  - Fix several crashes and rendering issues.

Translation updates :

  - German.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple Safari installed on the remote Mac OS X host is prior to 9.1.2. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in remote code execution, in the following components :

  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Page Loading

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location     variable, which allows remote attackers to access the local filesystem via unspecified vectors.
    (CVE-2016-4591)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of iOS running on the mobile device is prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in remote code execution, in the following components :

  - Calendar
  - CoreGraphics
  - FaceTime
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Safari
  - Sandbox Profiles
  - Siri Contacts
  - Web Media
  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Page Loading

According to its banner, the version of the remote Apple TV device is prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - CoreGraphics
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Sandbox Profiles
  - WebKit
  - WebKit Page Loading

Note that only 4th generation models are affected by the vulnerabilities.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3079-1 advisory.

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user     were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related     to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
9550	Safari < 9.1.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	9/9/2016	3/6/2019	medium
407555	Alpine: webkit2gtk: security update to 2.12.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
407555	Alpine: webkit2gtk: security update to 2.12.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
93139	Fedora 24 : webkitgtk4 (2016-4728dfe3ec)	Nessus	Fedora Local Security Checks	8/29/2016	1/28/2026	high
92358	Mac OS X : Apple Safari < 9.1.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	7/19/2016	1/30/2026	high
93264	Fedora 23 : webkitgtk4 (2016-d957ffbac1)	Nessus	Fedora Local Security Checks	9/2/2016	1/27/2026	high
254630	Linux Distros Unpatched Vulnerability : CVE-2016-4591	Nessus	Misc.	8/25/2025	7/18/2026	high
92359	Apple iOS < 9.3.3 Multiple Vulnerabilities	Nessus	Mobile Devices	7/19/2016	3/23/2026	critical
92494	Apple TV < 9.2.2 Multiple Vulnerabilities	Nessus	Misc.	7/21/2016	1/30/2026	critical
93511	Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3079-1)	Nessus	Ubuntu Local Security Checks	9/15/2016	8/27/2024	high

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high

critical

critical

high