An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sqlite: heap out-of-bound read in function rtreenode() (CVE-2019-8457)

  - The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows     remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL     command that triggers an API call with a crafted pointer value in the second argument. (CVE-2015-7036)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sqlite: stack buffer overflow in src/printf.c (CVE-2015-3416)

  - chromium-browser: pointer disclosure in sqlite (CVE-2017-7000)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - sqlite: Heap-buffer overflow in the getNodeSize function (CVE-2017-10989)

  - os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which     might allow local users to obtain sensitive information, cause a denial of service (application crash), or     have unspecified other impact by leveraging use of the current working directory for temporary files.
    (CVE-2016-6153)

  - The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service     (EXC_BAD_ACCESS and application crash) via a crafted file. (CVE-2017-13685)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote host is affected by the vulnerability described in GLSA-201709-15 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass security restrictions, or spoof content.
  Workaround :

    There is no known workaround at this time.

Update to 60.0.3112.113. Added support for aarch64 (except on EPEL7).

----

Update to 60.0.3112.101. Apply upstream fix for cameras reporting 0x0 resolution formats.

----

Chromium 60. Security fix for CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-7000, CVE-2017-5105, CVE-2017-5106, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110.

New subpackage -headless.

----

Update to 59.0.3071.115

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chromium 60. Security fix for CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-7000, CVE-2017-5105, CVE-2017-5106, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110.

New subpackage -headless.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Version 3.20.0.

Security fix for CVE-2017-7000

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-7000

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5087     Ned Williamson discovered a way to escape the sandbox.

  - CVE-2017-5088     Xiling Gong discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2017-5089     Michal Bentkowski discovered a spoofing issue.

  - CVE-2017-5091     Ned Williamson discovered a use-after-free issue in     IndexedDB.

  - CVE-2017-5092     Yu Zhou discovered a use-after-free issue in PPAPI.

  - CVE-2017-5093     Luan Herrera discovered a user interface spoofing issue.

  - CVE-2017-5094     A type confusion issue was discovered in extensions.

  - CVE-2017-5095     An out-of-bounds write issue was discovered in the     pdfium library.

  - CVE-2017-5097     An out-of-bounds read issue was discovered in the skia     library.

  - CVE-2017-5098     Jihoon Kim discovered a use-after-free issue in the v8     JavaScript library.

  - CVE-2017-5099     Yuan Deng discovered an out-of-bounds write issue in     PPAPI.

  - CVE-2017-5100     A use-after-free issue was discovered in Chrome Apps.

  - CVE-2017-5101     Luan Herrera discovered a URL spoofing issue.

  - CVE-2017-5102     An uninitialized variable was discovered in the skia     library.

  - CVE-2017-5103     Another uninitialized variable was discovered in the     skia library.

  - CVE-2017-5104     Khalil Zhani discovered a user interface spoofing issue.

  - CVE-2017-5105     Rayyan Bijoora discovered a URL spoofing issue.

  - CVE-2017-5106     Jack Zac discovered a URL spoofing issue.

  - CVE-2017-5107     David Kohlbrenner discovered an information leak in SVG     file handling.

  - CVE-2017-5108     Guang Gong discovered a type confusion issue in the     pdfium library.

  - CVE-2017-5109     Jose Maria Acuna Morgado discovered a user interface     spoofing issue.

  - CVE-2017-5110     xisigr discovered a way to spoof the payments dialog.

  - CVE-2017-7000     Chaitin Security Research Lab discovered an information     disclosure issue in the sqlite library.

Google Chrome releases reports :

40 security fixes in this release

Please reference CVE/URL list for details

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 60.0.3112.78.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-5106, CVE-2017-7000, CVE-2017-5105, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110)

This update Chromium to version 60.0.3112.78 fixes security issue and bugs.

The following security issues were fixed :

  - CVE-2017-5091: Use after free in IndexedDB

  - CVE-2017-5092: Use after free in PPAPI

  - CVE-2017-5093: UI spoofing in Blink

  - CVE-2017-5094: Type confusion in extensions

  - CVE-2017-5095: Out-of-bounds write in PDFium

  - CVE-2017-5096: User information leak via Android intents

  - CVE-2017-5097: Out-of-bounds read in Skia

  - CVE-2017-5098: Use after free in V8

  - CVE-2017-5099: Out-of-bounds write in PPAPI

  - CVE-2017-5100: Use after free in Chrome Apps

  - CVE-2017-5101: URL spoofing in OmniBox

  - CVE-2017-5102: Uninitialized use in Skia

  - CVE-2017-5103: Uninitialized use in Skia

  - CVE-2017-5104: UI spoofing in browser

  - CVE-2017-7000: Pointer disclosure in SQLite

  - CVE-2017-5105: URL spoofing in OmniBox

  - CVE-2017-5106: URL spoofing in OmniBox

  - CVE-2017-5107: User information leak via SVG

  - CVE-2017-5108: Type confusion in PDFium

  - CVE-2017-5109: UI spoofing in browser

  - CVE-2017-5110: UI spoofing in payments dialog

  - Various fixes from internal audits, fuzzing and other     initiatives

A number of upstream bugfixes are also included in this release.

The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 60.0.3112.78. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists in IndexedDB due to     improper handling of cursors during transactions. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5091)

  - A use-after-free error exists in the PPAPI component     that allows unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-5092)

  - An unspecified flaw exists in Blink that is triggered     when displaying JavaScript alerts in fullscreen mode. An     unauthenticated, remote attacker can exploit this to     spoof components in the user interface. (CVE-2017-5093)

  - A type confusion error exists in the 'Extensions     Bindings' component that is triggered when passing event     filters. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5094)

  - An overflow condition exists in PDFium due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5095)

  - An unspecified flaw exists related to 'Android intents'     that allows an unauthenticated, remote attacker to     disclose sensitive user information. (CVE-2017-5096)

  - An out-of-bounds read error exists in Skia due to     improper handling of verb arrays. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5097)

  - A use-after-free error exists in Google V8 that allows     an unauthenticated, remote attacker to execute arbitrary     code. (CVE-2017-5098)

  - An out-of-bounds write error exists in the PPAPI     component that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2017-5099)

  - A use-after-free error exists in the 'Chrome Apps'     component that allows an unauthenticated, remote     attacker to have an unspecified impact. (CVE-2017-5100)

  - Multiple unspecified flaws exist in the OmniBox     component that allow an unauthenticated, remote attacker     to spoof URLs in the address bar. (CVE-2017-5101,     CVE-2017-5105)

  - Multiple uninitialized memory use flaws exist in Skia     that allow an unauthenticated, remote attacker to have     an unspecified impact. (CVE-2017-5102, CVE-2017-5103)

  - Multiple unspecified flaws exist that allow an     unauthenticated, remote attacker to spoof components in     the user interface. (CVE-2017-5104, CVE-2017-5109)

  - A flaw exists in OmniBox that is triggered as domain     names containing arbitrary Cyrillic letters are rendered     in the address bar. An unauthenticated, remote attacker     can exploit this, via a specially crafted domain name,     to spoof the URL in the address bar. (CVE-2017-5106)

  - A flaw exists in the SVG filters component due to     improper handling of floating point multiplication. An     unauthenticated, remote attacker can exploit this, via a     timing attack, to extract sensitive user information.
    (CVE-2017-5107)

  - A type confusion error exists in Google V8 that allows     an unauthenticated, remote attacker to have an     unspecified impact. (CVE-2017-5108)

  - An unspecified flaw exists in the Payments dialog that     allows an unauthenticated, remote attacker to spoof     components in the user interface. (CVE-2017-5110)

  - A type confusion error exists in SQLite due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code. (CVE-2017-7000)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 60.0.3112.78. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists in IndexedDB due to     improper handling of cursors during transactions. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5091)

  - A use-after-free error exists in the PPAPI component     that allows unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-5092)

  - An unspecified flaw exists in Blink that is triggered     when displaying JavaScript alerts in fullscreen mode. An     unauthenticated, remote attacker can exploit this to     spoof components in the user interface. (CVE-2017-5093)

  - A type confusion error exists in the 'Extensions     Bindings' component that is triggered when passing event     filters. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5094)

  - An overflow condition exists in PDFium due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5095)

  - An unspecified flaw exists related to 'Android intents'     that allows an unauthenticated, remote attacker to     disclose sensitive user information. (CVE-2017-5096)

  - An out-of-bounds read error exists in Skia due to     improper handling of verb arrays. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5097)

  - A use-after-free error exists in Google V8 that allows     an unauthenticated, remote attacker to execute arbitrary     code. (CVE-2017-5098)

  - An out-of-bounds write error exists in the PPAPI     component that allows an unauthenticated, remote     attacker to execute arbitrary code. (CVE-2017-5099)

  - A use-after-free error exists in the 'Chrome Apps'     component that allows an unauthenticated, remote     attacker to have an unspecified impact. (CVE-2017-5100)

  - Multiple unspecified flaws exist in the OmniBox     component that allow an unauthenticated, remote attacker     to spoof URLs in the address bar. (CVE-2017-5101,     CVE-2017-5105)

  - Multiple uninitialized memory use flaws exist in Skia     that allow an unauthenticated, remote attacker to have     an unspecified impact. (CVE-2017-5102, CVE-2017-5103)

  - Multiple unspecified flaws exist that allow an     unauthenticated, remote attacker to spoof components in     the user interface. (CVE-2017-5104, CVE-2017-5109)

  - A flaw exists in OmniBox that is triggered as domain     names containing arbitrary Cyrillic letters are rendered     in the address bar. An unauthenticated, remote attacker     can exploit this, via a specially crafted domain name,     to spoof the URL in the address bar. (CVE-2017-5106)

  - A flaw exists in the SVG filters component due to     improper handling of floating point multiplication. An     unauthenticated, remote attacker can exploit this, via a     timing attack, to extract sensitive user information.
    (CVE-2017-5107)

  - A type confusion error exists in Google V8 that allows     an unauthenticated, remote attacker to have an     unspecified impact. (CVE-2017-5108)

  - An unspecified flaw exists in the Payments dialog that     allows an unauthenticated, remote attacker to spoof     components in the user interface. (CVE-2017-5110)

  - A type confusion error exists in SQLite due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code. (CVE-2017-7000)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS that is 10.12.x prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the Kernel     component that allow a local attacker to gain     kernel-level privileges. (CVE-2017-2494, CVE-2017-2546)

  - A state management flaw exists in the iBooks component     due to improper handling of URLs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted book, to open arbitrary websites without user     permission. (CVE-2017-2497)

  - A local privilege escalation vulnerability exists in the     Kernel component due to a race condition. A local     attacker can exploit this to execute arbitrary code with     kernel-level privileges. (CVE-2017-2501)

  - An information disclosure vulnerability exists in the     CoreAudio component due to improper sanitization of     user-supplied input. A local attacker can exploit this     to read the contents of restricted memory.
    (CVE-2017-2502)

  - A memory corruption issue exists in the Intel graphics     driver component that allows a local attacker to execute     arbitrary code with kernel-level privileges.
    CVE-2017-2503)

  - Multiple information disclosure vulnerabilities exist     in the Kernel component due to improper sanitization of     user-supplied input. A local attacker can exploit these     to read the contents of restricted memory.
    (CVE-2017-2507, CVE-2017-2509, CVE-2017-2516,     CVE-2017-6987)

  - A memory corruption issue exists in the Sandbox     component that allows an unauthenticated, remote     attacker to escape an application sandbox.
    (CVE-2017-2512)

  - A use-after-free error exists in the SQLite component     when handling SQL queries. An unauthenticated, remote     attacker can exploit this to deference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-2513)

  - Multiple buffer overflow conditions exist in the SQLite     component due to the improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit these, via a specially crafted SQL query, to     execute arbitrary code. (CVE-2017-2518, CVE-2017-2520)

  - A memory corruption issue exists in the SQLite component     when handling SQL queries. An unauthenticated, remote     attacker can exploit this, via a specially crafted SQL     query, to execute arbitrary code. (CVE-2017-2519)

  - An unspecified memory corruption issue exists in the     TextInput component when parsing specially crafted data.
    An unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2524)

  - A flaw exists in the CoreAnimation component when     handling specially crafted data. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code. (CVE-2017-2527)

  - A race condition exists in the DiskArbitration feature     that allow a local attacker to gain system-level     privileges. (CVE-2017-2533)

  - An unspecified flaw exists in the Speech Framework that     allows a local attacker to escape an application     sandbox. (CVE-2017-2534)

  - A resource exhaustion issue exists in the Security     component due to improper validation of user-supplied     input. A local attacker can exploit this to exhaust     resources and escape an application sandbox.
    (CVE-2017-2535)

  - Multiple memory corruption issues exist in the     WindowServer component that allow a local attacker to     execute arbitrary code with system-level privileges.
    (CVE-2017-2537, CVE-2017-2548)

  - An information disclosure vulnerability exists in     WindowServer component in the _XGetConnectionPSN()     function due to improper validation of user-supplied     input. A local attacker can exploit this to read the     contents of restricted memory. (CVE-2017-2540)

  - A stack-based buffer overflow condition exists in the     WindowServer component in the _XGetWindowMovementGroup()     function due to improper validation of user-supplied     input. A local attacker can exploit this to execute     arbitrary code with the privileges of WindowServer.
    (CVE-2017-2541)

  - Multiple memory corruption issues exist in the     Multi-Touch component that allow a local attacker to     execute arbitrary code with kernel-level privileges.
    (CVE-2017-2542, CVE-2017-2543)

  - A use-after-free error exists in the IOGraphic component     that allows a local attacker to execute arbitrary code     with kernel-level privileges. (CVE-2017-2545)

  - A flaw exists in the Speech Framework, specifically     within the speechsynthesisd service, due to improper     validation of unsigned dynamic libraries (.dylib) before     being loaded. A local attacker can exploit this to     bypass the application's sandbox and execute arbitrary     code with elevated privileges. (CVE-2017-6977)

  - A memory corruption issue exists in the Accessibility     Framework that allows a local attacker to execute     arbitrary code with system-level privileges.
    (CVE-2017-6978)

  - A race condition exists in the IOSurface component that     allows a local attacker to execute arbitrary code with     kernel-level privileges. (CVE-2017-6979)

  - A logic error exists in the iBooks component due to     improper path validation for symlinks. A local attacker     can exploit this to execute arbitrary code with root     privileges. (CVE-2017-6981)

  - Multiple memory corruption issues exist in SQLite due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these, by     convincing a user to visit a specially crafted website,     to execute arbitrary code. (CVE-2017-6983,     CVE-2017-6991)

  - A memory corruption issue exists in the NVIDIA graphics     drivers that allows a local attacker to execute     arbitrary code with kernel-level privileges.
    (CVE-2017-6985)

  - A memory corruption issue exists in the iBooks component     that allows an unauthenticated, remote attacker to     escape an application's sandbox. (CVE-2017-6986)

  - A certificate validation flaw exists in EAP-TLS within     802.1X authentication when a certificate has changed.
    An unauthenticated, adjacent attacker can exploit this,     via a malicious network with 802.1X authentication, to     capture user network credentials. (CVE-2017-6988)

  - An information disclosure vulnerability exists in HFS     component due to improper sanitization of user-supplied     input. A local attacker can exploit this to read the     contents of restricted memory. (CVE-2017-6990)

  - Multiple type confusion flaws exist in SQLite due to     improper validation of user-supplied input to 'snippet',     'offsets', and 'matchinfo'. An unauthenticated, remote     attacker can exploit these, by convincing a user to     visit a specially crafted website, to execute arbitrary     code. (CVE-2017-7000, CVE-2017-7001, CVE-2017-7002)

  - A denial of service vulnerability exists in the     CoreText component due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, via a specially crafted file, to crash     an application. (CVE-2017-7003)

  - A race condition exists when performing userspace     entitlement checks. A local attacker can exploit this to     bypass restrictions and send privileged XPC messages     without entitlements. (CVE-2017-7004)

The version of Apple iOS running on the mobile device is prior to 10.3.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the WebKit     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these issues, by convincing a user to visit a specially     crafted website, to execute arbitrary code.
    (CVE-2017-2496, CVE-2017-2505, CVE-2017-2506,     CVE-2017-2514, CVE-2017-2515, CVE-2017-2521,     CVE-2017-2525, CVE-2017-2526, CVE-2017-2530,     CVE-2017-2531, CVE-2017-2538, CVE-2017-2539,     CVE-2017-2544, CVE-2017-2547, CVE-2017-6980,     CVE-2017-6984)

  - A security bypass vulnerability exists in the Security     component in the certificate trust policy. An     unauthenticated, remote attacker can exploit this to     cause untrusted certificates to be treated at trusted.
    (CVE-2017-2498)

  - A memory corruption issue exists in the WebKit Web     Inspector component that allows an unauthenticated,     remote attacker to execute arbitrary code.
    (CVE-2017-2499)

  - An unspecified flaw exists in the Safari component in     the history menu functionality. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition. (CVE-2017-2495)

  - A state management flaw exists in the iBooks component     due to improper handling of URLs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted book, to open arbitrary websites without user     permission. (CVE-2017-2497)

  - A local privilege escalation vulnerability exists in the     Kernel component due to a race condition. A local     attacker can exploit this to execute arbitrary code with     kernel-level privileges. (CVE-2017-2501)

  - An information disclosure vulnerability exists in the     CoreAudio component due to improper sanitization of     user-supplied input. A local attacker can exploit this     to read the contents of restricted memory.
    (CVE-2017-2502)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in WebKit due to improper handling     of WebKit Editor commands, container nodes, pageshow     events, frame loading, and cached frames. An     unauthenticated, remote attacker can exploit this, via a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2504,     CVE-2017-2508, CVE-2017-2510, CVE-2017-2528,     CVE-2017-2549)

  - Multiple information disclosure vulnerabilities exist     in the Kernel component due to improper sanitization of     user-supplied input. A local attacker can exploit these     to read the contents of restricted memory.
    (CVE-2017-2507, CVE-2017-6987)

  - A use-after-free error exists in the SQLite component     when handling SQL queries. An unauthenticated, remote     attacker can exploit this to deference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-2513)

  - Multiple buffer overflow conditions exist in the SQLite     component due to the improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit these, via a specially crafted SQL query, to     execute arbitrary code. (CVE-2017-2518, CVE-2017-2520)

  - A memory corruption issue exists in the SQLite component     when handling SQL queries. An unauthenticated, remote     attacker can exploit this, via a specially crafted SQL     query, to execute arbitrary code. (CVE-2017-2519)

  - An unspecified memory corruption issue exists in the     TextInput component when parsing specially crafted data.
    An unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2524)

  - Multiple unspecified flaws exist in WebKit that allow     an unauthenticated, remote attacker to corrupt memory     and execute arbitrary code by using specially crafted     web content. (CVE-2017-2536)

  - An unspecified flaw exists in the IOSurface component     that allows a local attacker to corrupt memory and     execute arbitrary code with kernel-level privileges.
    (CVE-2017-6979)

  - A logic error exists in the iBooks component due to     improper path validation for symlinks. A local attacker     can exploit this to execute arbitrary code with root     privileges. (CVE-2017-6981)

  - An unspecified flaw exists in the Notifications     component that allows a local attacker to cause a denial     of service condition via a specially crafted     application. (CVE-2017-6982)

  - Multiple memory corruption issues exist in SQLite due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these, by     convincing a user to visit a specially crafted website,     to execute arbitrary code.
    (CVE-2017-6983, CVE-2017-6991)

  - An unspecified flaw exists in the AVEVideoEncoder     component that allows a local attacker, via a specially     crafted application, to corrupt memory and execute     arbitrary code with kernel-level privileges.
    (CVE-2017-6989)

  - Multiple type confusion flaws exist in SQLite due to     improper validation of user-supplied input to 'snippet',     'offsets', and 'matchinfo'. An unauthenticated, remote     attacker can exploit these, by convincing a user to     visit a specially crafted website, to execute arbitrary     code. (CVE-2017-7000, CVE-2017-7001, CVE-2017-7002)

  - A denial of service vulnerability exists in the     CoreText component due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, via a specially crafted file, to crash     an application. (CVE-2017-7003)

  - A race condition exists when performing userspace     entitlement checks. A local attacker can exploit this to     bypass restrictions and send privileged XPC messages     without entitlements. (CVE-2017-7004)

  - A memory corruption issue exists in the JavaScriptCore     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, via specially crafted web content, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2017-7005)

The remote host is running a version of Mac OS X version 10.x prior to 10.12.5, and is affected by multiple vulnerabilities :

 - An overflow condition exists in the '_XGetWindowMovementGroup()' function within the WindowServer component that is triggered as certain input is not properly validated. This may allow a local attacker to cause a stack-based buffer overflow and potentially execute arbitrary code with the privileges of WindowServer.
 - An unspecified flaw exists in the Intel graphics driver. This may allow a local attacker to corrupt memory and potentially execute arbitrary code with kernel-level privileges.
 - An unspecified flaw exists in the NVIDIA graphics drivers. This may allow a local attacker to corrupt memory and potentially execute arbitrary code with kernel-level privileges.
 - A flaw exists in the speechsynthesisd service, as unsigned dynamic libraries (.dylib) are improperly validated before being loaded. This may allow a local attacker to bypass an application's sandbox and execute arbitrary code with elevated privileges.
 - An unspecified flaw exists in the Speech Framework. This may allow an attacker to escape an application sandbox.
 - A certificate validation flaw exists in 802.1X authentication that is triggered in EAP-TLS when a certificate has changed. This may allow a context-dependent attacker to disclose user network credentials.
 - A type confusion flaw exists in SQLite that is triggered as certain input related to 'snippet' is not properly validated. With specially crafted web content, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.

This product is also affected by vulnerabilities found in the following components:

 - Accessibility
 - CoreAnimation
 - CoreAudio
 - CoreFoundation
 - DiskArbitration
 - Foundation
 - HFS
 - iBooks
 - IOSurface
 - Kernel)
 - Multi-Touch 
 - SQLite
 - Sandbox
 - Security
 - TextInput
 - WindowServer

The version of iOS running on the mobile device is prior to 10.3.2, and is affected by multiple vulnerabilities :

 - A use-after-free error exists in the handling of RenderElement objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderLayer objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderInline objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to the certificate trust policy that is triggered when handling trust acceptance. This may allow a context-dependent attacker to potentially cause untrusted certificates to be treated as trusted.
 - An unspecified flaw exists in the Safari history menu. With a specially crafted web page, a context-dependent attacker can cause an application denial of service.
 - A logic flaw exists that allows a universal cross-site scripting (UXSS) attack. The issue is triggered when handling WebKit Editor commands. This may allow a context-dependent attacker to create a specially crafted web page that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and any website.
 - A type confusion flaw exists in SQLite that is triggered as certain input related to 'snippet' is not properly validated. With specially crafted web content, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.

This product is also affected by vulnerabilities found in the following components:

 - AVEVideoEncoder
 - CoreAudio
 - CoreFoundation
 - Foundation
 - iBooks 
 - IOSurface
 - Kernel
 - TextInput
 - Notifications
 - SQLite
 - WebKit
 - Web Inspector 

ID	Name	Product	Family	Severity
199469	RHEL 7 : sqlite (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199465	RHEL 5 : sqlite (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199438	RHEL 6 : sqlite (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196882	RHEL 6 : chromium-browser (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196814	RHEL 7 : chromium-browser (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196791	RHEL 5 : chromium-browser (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
103443	GLSA-201709-15 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
103104	Fedora 25 : chromium (2017-c708c044e3)	Nessus	Fedora Local Security Checks	high
102612	Fedora 26 : chromium (2017-f79ae2b96f)	Nessus	Fedora Local Security Checks	high
102455	Fedora 26 : spatialite-tools / sqlite (2017-5f2b220c7c)	Nessus	Fedora Local Security Checks	high
102454	Fedora 25 : sqlite (2017-571e659c85)	Nessus	Fedora Local Security Checks	high
102210	Debian DSA-3926-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
102101	FreeBSD : chromium -- multiple vulnerabilities (7d138476-7710-11e7-88a1-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high
102090	RHEL 6 : chromium-browser (RHSA-2017:1833)	Nessus	Red Hat Local Security Checks	high
102054	openSUSE Security Update : chromium (openSUSE-2017-854)	Nessus	SuSE Local Security Checks	high
101981	Google Chrome < 60.0.3112.78 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
101980	Google Chrome < 60.0.3112.78 Multiple Vulnerabilities	Nessus	Windows	high
100270	macOS 10.12.x < 10.12.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
100269	Apple iOS < 10.3.2 Multiple Vulnerabilities	Nessus	Mobile Devices	high
700119	Mac OS X 10.x < 10.12.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
700116	Apple iOS < 10.3.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical

Detections

Analytics

CVE-2017-7000

high

Tenable Plugins

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical