This update addresses the following vulnerabilities :

  -     [CVE-2017-2538](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2017-2538)

Additional fixes :

  - Fix web process deadlock when seeking youtube videos.

  - Fix blob downloads.

  - Improve theme rendering performance when using GTK+ >=     3.20.

  - Fix positioning of popup menus in Wayland.

  - Fix JavaScriptCore crashes on big-endian architectures

  - Fix a web process crash when page finishes loading in     several websites.

  - Fix the menu of select elements not showing in some     cases under Wayland.

  - Fix several crashes and rendering issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201709-03 (WebKitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebkitGTK+. Please       review the references below for details.
  Impact :

    A remote attacker could execute arbitrary code via crafted web content.
  Workaround :

    There is no known workaround at this time.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 10.1.1. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the history menu     functionality. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.
    (CVE-2017-2495)

  - Multiple memory corruption issues exist in the WebKit     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these issues, by convincing a user to visit a specially     crafted website, to execute arbitrary code.
    (CVE-2017-2496, CVE-2017-2505, CVE-2017-2506,     CVE-2017-2514, CVE-2017-2515, CVE-2017-2521,     CVE-2017-2525, CVE-2017-2526, CVE-2017-2530,     CVE-2017-2531, CVE-2017-2538, CVE-2017-2539,     CVE-2017-2544, CVE-2017-2547, CVE-2017-6980,     CVE-2017-6984)

  - A memory corruption issue exists in the WebKit Web     Inspector component that allows an unauthenticated,     remote attacker to execute arbitrary code.
    (CVE-2017-2499)

  - An address bar spoofing vulnerability exists due to     improper state management. An unauthenticated, remote     attacker can exploit this to spoof the address in the     address bar. (CVE-2017-2500, CVE-2017-2511)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in WebKit due to improper handling     of WebKit Editor commands, container nodes, pageshow     events, frame loading, and cached frames. An     unauthenticated, remote attacker can exploit this, via a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2504,     CVE-2017-2508, CVE-2017-2510, CVE-2017-2528,     CVE-2017-2549)

  - Multiple unspecified flaws exist in WebKit that allow     an unauthenticated, remote attacker to corrupt memory     and execute arbitrary code by using specially crafted     web content. (CVE-2017-2536)

This update for webkit2gtk3 to version 2.18.0 fixes the following issues: These security issues were fixed :

  - CVE-2017-7039: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7018: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7030: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7037: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7034: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7055: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7056: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7064: An issue was fixed that allowed remote     attackers to bypass intended memory-read restrictions     via a crafted app (bsc#1050469).

  - CVE-2017-7061: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7048: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7046: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-2538: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1045460)

  - CVE-2017-2496: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2539: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2510: An issue was fixed that allowed remote     attackers to conduct Universal XSS (UXSS) attacks via a     crafted website that improperly interacts with pageshow     events.

  - CVE-2017-2365: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2366: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2373: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2363: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2362: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2354: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749).

  - CVE-2017-2355: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access and application     crash) via a crafted website (bsc#1024749)

  - CVE-2017-2356: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2371: An issue was fixed that allowed remote     attackers to launch popups via a crafted website     (bsc#1024749)

  - CVE-2017-2364: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2369: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2016-7656: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7635: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7654: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7639: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7645: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7652: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7641: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7632: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7599: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website that used     HTTP redirects (bsc#1020950)

  - CVE-2016-7592: An issue was fixed that allowed remote     attackers to obtain sensitive information via crafted     JavaScript prompts on a web site (bsc#1020950)

  - CVE-2016-7589: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7623: An issue was fixed that allowed remote     attackers to obtain sensitive information via a blob URL     on a website (bsc#1020950)

  - CVE-2016-7586: An issue was fixed that allowed remote     attackers to obtain sensitive information via a crafted     website (bsc#1020950) For other non-security fixes     please check the changelog.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses the following vulnerabilities :

  -     [CVE-2017-2538](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2017-2538)

Additional fixes :

  - Fix web process deadlock when seeking youtube videos.

  - Fix blob downloads.

  - Improve theme rendering performance when using GTK+ >=     3.20.

  - Fix positioning of popup menus in Wayland.

  - Fix several crashes and rendering issues.

  - Fix JavaScriptCore crashes on big-endian architectures

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for webkit2gtk3 to version 2.18.0 fixes the following issues :

These security issues were fixed :

  - CVE-2017-7039: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7018: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7030: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7037: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7034: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7055: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7056: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7064: An issue was fixed that allowed remote     attackers to bypass intended memory-read restrictions     via a crafted app (bsc#1050469).

  - CVE-2017-7061: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7048: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7046: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-2538: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1045460)

  - CVE-2017-2496: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2539: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2510: An issue was fixed that allowed remote     attackers to conduct Universal XSS (UXSS) attacks via a     crafted website that improperly interacts with pageshow     events.

  - CVE-2017-2365: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2366: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2373: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2363: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2362: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2354: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749).

  - CVE-2017-2355: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access and application     crash) via a crafted website (bsc#1024749)

  - CVE-2017-2356: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2371: An issue was fixed that allowed remote     attackers to launch popups via a crafted website     (bsc#1024749)

  - CVE-2017-2364: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2369: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2016-7656: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7635: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7654: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7639: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7645: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7652: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7641: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7632: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7599: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site that used     HTTP redirects (bsc#1020950)

  - CVE-2016-7592: An issue was fixed that allowed remote     attackers to obtain sensitive information via crafted     JavaScript prompts on a website (bsc#1020950)

  - CVE-2016-7589: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7623: An issue was fixed that allowed remote     attackers to obtain sensitive information via a blob URL     on a website (bsc#1020950)

  - CVE-2016-7586: An issue was fixed that allowed remote     attackers to obtain sensitive information via a crafted     website (bsc#1020950)

For other non-security fixes please check the changelog.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The version of Apple iOS running on the mobile device is prior to 10.3.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the WebKit     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these issues, by convincing a user to visit a specially     crafted website, to execute arbitrary code.
    (CVE-2017-2496, CVE-2017-2505, CVE-2017-2506,     CVE-2017-2514, CVE-2017-2515, CVE-2017-2521,     CVE-2017-2525, CVE-2017-2526, CVE-2017-2530,     CVE-2017-2531, CVE-2017-2538, CVE-2017-2539,     CVE-2017-2544, CVE-2017-2547, CVE-2017-6980,     CVE-2017-6984)

  - A security bypass vulnerability exists in the Security     component in the certificate trust policy. An     unauthenticated, remote attacker can exploit this to     cause untrusted certificates to be treated at trusted.
    (CVE-2017-2498)

  - A memory corruption issue exists in the WebKit Web     Inspector component that allows an unauthenticated,     remote attacker to execute arbitrary code.
    (CVE-2017-2499)

  - An unspecified flaw exists in the Safari component in     the history menu functionality. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition. (CVE-2017-2495)

  - A state management flaw exists in the iBooks component     due to improper handling of URLs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted book, to open arbitrary websites without user     permission. (CVE-2017-2497)

  - A local privilege escalation vulnerability exists in the     Kernel component due to a race condition. A local     attacker can exploit this to execute arbitrary code with     kernel-level privileges. (CVE-2017-2501)

  - An information disclosure vulnerability exists in the     CoreAudio component due to improper sanitization of     user-supplied input. A local attacker can exploit this     to read the contents of restricted memory.
    (CVE-2017-2502)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in WebKit due to improper handling     of WebKit Editor commands, container nodes, pageshow     events, frame loading, and cached frames. An     unauthenticated, remote attacker can exploit this, via a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2504,     CVE-2017-2508, CVE-2017-2510, CVE-2017-2528,     CVE-2017-2549)

  - Multiple information disclosure vulnerabilities exist     in the Kernel component due to improper sanitization of     user-supplied input. A local attacker can exploit these     to read the contents of restricted memory.
    (CVE-2017-2507, CVE-2017-6987)

  - A use-after-free error exists in the SQLite component     when handling SQL queries. An unauthenticated, remote     attacker can exploit this to deference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-2513)

  - Multiple buffer overflow conditions exist in the SQLite     component due to the improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit these, via a specially crafted SQL query, to     execute arbitrary code. (CVE-2017-2518, CVE-2017-2520)

  - A memory corruption issue exists in the SQLite component     when handling SQL queries. An unauthenticated, remote     attacker can exploit this, via a specially crafted SQL     query, to execute arbitrary code. (CVE-2017-2519)

  - An unspecified memory corruption issue exists in the     TextInput component when parsing specially crafted data.
    An unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2524)

  - Multiple unspecified flaws exist in WebKit that allow     an unauthenticated, remote attacker to corrupt memory     and execute arbitrary code by using specially crafted     web content. (CVE-2017-2536)

  - An unspecified flaw exists in the IOSurface component     that allows a local attacker to corrupt memory and     execute arbitrary code with kernel-level privileges.
    (CVE-2017-6979)

  - A logic error exists in the iBooks component due to     improper path validation for symlinks. A local attacker     can exploit this to execute arbitrary code with root     privileges. (CVE-2017-6981)

  - An unspecified flaw exists in the Notifications     component that allows a local attacker to cause a denial     of service condition via a specially crafted     application. (CVE-2017-6982)

  - Multiple memory corruption issues exist in SQLite due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these, by     convincing a user to visit a specially crafted website,     to execute arbitrary code.
    (CVE-2017-6983, CVE-2017-6991)

  - An unspecified flaw exists in the AVEVideoEncoder     component that allows a local attacker, via a specially     crafted application, to corrupt memory and execute     arbitrary code with kernel-level privileges.
    (CVE-2017-6989)

  - Multiple type confusion flaws exist in SQLite due to     improper validation of user-supplied input to 'snippet',     'offsets', and 'matchinfo'. An unauthenticated, remote     attacker can exploit these, by convincing a user to     visit a specially crafted website, to execute arbitrary     code. (CVE-2017-7000, CVE-2017-7001, CVE-2017-7002)

  - A denial of service vulnerability exists in the     CoreText component due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, via a specially crafted file, to crash     an application. (CVE-2017-7003)

  - A race condition exists when performing userspace     entitlement checks. A local attacker can exploit this to     bypass restrictions and send privileged XPC messages     without entitlements. (CVE-2017-7004)

  - A memory corruption issue exists in the JavaScriptCore     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, via specially crafted web content, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2017-7005)

The version of iOS running on the mobile device is prior to 10.3.2, and is affected by multiple vulnerabilities :

 - A use-after-free error exists in the handling of RenderElement objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderLayer objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderInline objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to the certificate trust policy that is triggered when handling trust acceptance. This may allow a context-dependent attacker to potentially cause untrusted certificates to be treated as trusted.
 - An unspecified flaw exists in the Safari history menu. With a specially crafted web page, a context-dependent attacker can cause an application denial of service.
 - A logic flaw exists that allows a universal cross-site scripting (UXSS) attack. The issue is triggered when handling WebKit Editor commands. This may allow a context-dependent attacker to create a specially crafted web page that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and any website.
 - A type confusion flaw exists in SQLite that is triggered as certain input related to 'snippet' is not properly validated. With specially crafted web content, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.

This product is also affected by vulnerabilities found in the following components:

 - AVEVideoEncoder
 - CoreAudio
 - CoreFoundation
 - Foundation
 - iBooks 
 - IOSurface
 - Kernel
 - TextInput
 - Notifications
 - SQLite
 - WebKit
 - Web Inspector 

Versions of Safari prior to 10.1.1 are affected by multiple vulnerabilities :

 - A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderElement objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderLayer objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderInline objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the Safari history menu. With a specially crafted web page, a context-dependent attacker can cause an application denial of service.
 - A flaw exists related to an inconsistent user interface. This may allow a context-dependent attacker to spoof the address bar.
 - A logic flaw exists that allows a UXSS attack. The issue is triggered when handling container nodes. This may allow a context-dependent attacker to create a specially crafted web page that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and any website.
 - A flaw exists related to an inconsistent user interface. This may allow a context-dependent attacker to spoof the address bar.

This product is also affected by vulnerabilities found in the following components:

 - WebKit 
 - Web Inspector

ID	Name	Product	Family	Published	Updated	Severity
101991	Fedora 24 : webkitgtk4 (2017-37f68e3534)	Nessus	Fedora Local Security Checks	7/27/2017	1/11/2021	high
102161	Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3376-1)	Nessus	Ubuntu Local Security Checks	8/3/2017	10/20/2023	high
103271	GLSA-201709-03 : WebKitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/18/2017	1/11/2021	high
100355	macOS : Apple Safari < 10.1.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	5/23/2017	11/13/2019	high
104428	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2017:2933-1)	Nessus	SuSE Local Security Checks	11/7/2017	1/6/2021	high
101328	Fedora 25 : webkitgtk4 (2017-bff1b87765)	Nessus	Fedora Local Security Checks	7/10/2017	1/6/2021	high
101658	Fedora 26 : webkitgtk4 (2017-772bf90b03)	Nessus	Fedora Local Security Checks	7/17/2017	1/6/2021	high
104526	openSUSE Security Update : webkit2gtk3 (openSUSE-2017-1268)	Nessus	SuSE Local Security Checks	11/13/2017	1/19/2021	high
100269	Apple iOS < 10.3.2 Multiple Vulnerabilities	Nessus	Mobile Devices	5/18/2017	4/8/2024	high
700116	Apple iOS < 10.3.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	5/17/2017	3/6/2019	critical
700117	Safari < 10.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	5/18/2017	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

critical

medium