Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-201909-05 (WebkitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebkitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker, by enticing a user to visit maliciously crafted web       content, may be able to execute arbitrary code or cause memory       corruption.
  Workaround :

    There is no known workaround at this time.

The WebKitGTK project reports many vulnerabilities, including several arbitrary code execution vulnerabilities.

This update for webkit2gtk3 to version 2.24.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-6201, CVE-2019-6251, CVE-2019-7285,     CVE-2019-7292, CVE-2019-8503, CVE-2019-8506,     CVE-2019-8515, CVE-2019-8524, CVE-2019-8535,     CVE-2019-8536, CVE-2019-8544, CVE-2019-8551,     CVE-2019-8558, CVE-2019-8559, CVE-2019-8563,     CVE-2019-11070 (bsc#1132256).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for webkit2gtk3 to version 2.24.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-6201, CVE-2019-6251, CVE-2019-7285,     CVE-2019-7292, CVE-2019-8503, CVE-2019-8506,     CVE-2019-8515, CVE-2019-8518, CVE-2019-8523,     CVE-2019-8524, CVE-2019-8535, CVE-2019-8536,     CVE-2019-8544, CVE-2019-8551, CVE-2019-8558,     CVE-2019-8559, CVE-2019-8563, CVE-2019-11070     (bsc#1132256). This update was imported from the     SUSE:SLE-15:Update update project.

This update for webkit2gtk3 to version 2.24.1 fixes the following issues :

Security issues fixed :

CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for webkit2gtk3 to version 2.24.1 fixes the following issues :

Security issues fixed :

CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iOS running on the mobile device is prior to 12.2. It is, therefore, affected by multiple vulnerabilities:

 - An unspecified memory corruption issue could allow an attacker to execute code with kernel privileges. (CVE-2019-8529)

 - An unspecified buffer overflow issues was addressed that could address an attacker to cause unexpected system termination or corrupt kernel memory. (CVE-2019-8527)

 - An unspecified memory corruption issue in an SMS Link could allow an attacker arbitrary execute code. (CVE-2019-8553)

The version of Apple iOS running on the mobile device is prior to 12.2. It is, therefore, affected by multiple vulnerabilities:

  - An unspecified memory corruption issue could allow an     attacker to execute code with kernel privileges.
    (CVE-2019-8529)

  - An unspecified buffer overflow issues was addressed     that could address an attacker to cause unexpected     system termination or corrupt kernel memory.
    (CVE-2019-8527)

  - An unspecified memory corruption issue in an SMS Link     could allow an attacker arbitrary execute code.     (CVE-2019-8553)

ID	Name	Product	Family	Severity
128594	GLSA-201909-05 : WebkitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
126519	FreeBSD : webkit2-gtk3 -- Multiple vulnerabilities (3dd46e05-9fb0-11e9-bf65-00012e582166)	Nessus	FreeBSD Local Security Checks	high
125019	openSUSE Security Update : webkit2gtk3 (openSUSE-2019-1391)	Nessus	SuSE Local Security Checks	high
124851	openSUSE Security Update : webkit2gtk3 (openSUSE-2019-1374)	Nessus	SuSE Local Security Checks	high
124674	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2019:1155-1)	Nessus	SuSE Local Security Checks	high
124645	SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:1137-1)	Nessus	SuSE Local Security Checks	high
700558	Apple iOS < 12.2 Multiple Vulnerabilities (APPLE-SA-2019-3-25-1)	Nessus Network Monitor	Mobile Devices	high
123080	Apple iOS < 12.2 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2019-6201

high

Tenable Plugins

high

high

high

high

high

high

high

critical