A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

The version of Apple iOS running on the mobile device is prior to 12.0. It is, therefore, affected by multiple vulnerabilities.

The version of Apple Safari installed on the remote host is prior to 12. It is, therefore, affected by multiple vulnerabilities.

This update for webkit2gtk3 to version 2.22.5 fixes the following issues :

Security issues fixed :

  - CVE-2018-4372, CVE-2018-4345, CVE-2018-4386,     CVE-2018-4375, CVE-2018-4376, CVE-2018-4378,     CVE-2018-4382, CVE-2018-4392, CVE-2018-4416,     CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,     CVE-2018-4306, CVE-2018-4309, CVE-2018-4312,     CVE-2018-4314, CVE-2018-4315, CVE-2018-4316,     CVE-2018-4317, CVE-2018-4318, CVE-2018-4319,     CVE-2018-4323, CVE-2018-4328, CVE-2018-4358,     CVE-2018-4359, CVE-2018-4361, CVE-2018-4373,     CVE-2018-4162, CVE-2018-4163, CVE-2018-4165,     CVE-2018-11713, CVE-2018-4207, CVE-2018-4208,     CVE-2018-4209, CVE-2018-4210, CVE-2018-4212,     CVE-2018-4213, CVE-2018-4437, CVE-2018-4438,     CVE-2018-4441, CVE-2018-4442, CVE-2018-4443,     CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

This update was imported from the SUSE:SLE-15:Update update project.

This update for webkit2gtk3 to version 2.22.4 fixes the following issues :

Security issues fixed :

CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4392, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4345, CVE-2018-4372, CVE-2018-4373, CVE-2018-4375, CVE-2018-4376, CVE-2018-4416, CVE-2018-4378, CVE-2018-4382, CVE-2018-4386 (bsc#1110279, bsc#1116998). This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for webkit2gtk3 to version 2.22.5 fixes the following issues :

Security issues fixed :

CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4373, CVE-2018-4162, CVE-2018-4163, CVE-2018-4165, CVE-2018-11713, CVE-2018-4207, CVE-2018-4208, CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213, CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for webkit2gtk3 to version 2.22.4 fixes the following issues :

Security issues fixed :

CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4392, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4345, CVE-2018-4372, CVE-2018-4373, CVE-2018-4375, CVE-2018-4376, CVE-2018-4416, CVE-2018-4378, CVE-2018-4382, CVE-2018-4386 (bsc#1110279, bsc#1116998).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses the following vulnerability :

  -     [CVE-2018-4345](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2018-4345)

This update brings the following changes :

  - Many improvements and fixes for video playback with     media source extensions (MSE), which improve the user     experience across the board, and in particular for     playback of WebM videos.

  - Fix a memory leak during media playback when using     playbin3.

  - Fix portions of Web views not being rendered after     resizing.

  - Fix Resource Timing reporting for iframe elements.

  - Fix the build with the remote Web Inspector disabled.

  - Fix the build on ARMv7 with NEON extensions.

  - Fix several crashes and rendering issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3828-1 advisory.

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user     were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related     to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.9. It is, therefore, affected by multiple vulnerabilities as referenced in the HT209140 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.9. It is, therefore, affected by multiple vulnerabilities in WebKit as referenced in the HT209140 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
700552	Apple iOS < 12.0 Multiple Vulnerabilities (EFAIL, APPLE-SA-2018-9-24-4 and APPLE-SA-2018-10-30-8)	Nessus Network Monitor	Mobile Devices	medium
700505	Apple Safari < 12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
121339	openSUSE Security Update : webkit2gtk3 (openSUSE-2019-81)	Nessus	SuSE Local Security Checks	high
121291	openSUSE Security Update : webkit2gtk3 (openSUSE-2019-68)	Nessus	SuSE Local Security Checks	high
121206	SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:0092-1)	Nessus	SuSE Local Security Checks	high
121093	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2019:0059-1)	Nessus	SuSE Local Security Checks	high
120664	Fedora 29 : webkit2gtk3 (2018-a1f37d2f08)	Nessus	Fedora Local Security Checks	medium
120420	Fedora 28 : webkit2gtk3 (2018-509fc4a5c8)	Nessus	Fedora Local Security Checks	medium
119255	Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-3828-1)	Nessus	Ubuntu Local Security Checks	high
117880	Apple iTunes < 12.9 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
117879	Apple iTunes < 12.9 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
117632	Apple iOS < 12.0 Multiple Vulnerabilities (EFAIL)	Nessus	Mobile Devices	critical
117617	macOS : Apple Safari < 12 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2018-4345

medium

Tenable Plugins

medium

critical

high

high

high

high

medium

medium

high

high

high

critical

high