The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, iOS 16.7.8 and iPadOS 16.7.8, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, tvOS 17.5, visionOS 1.2. Processing a file may lead to unexpected app termination or arbitrary code execution.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9553 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process     crash (CVE-2024-44185)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process     crash (CVE-2024-44244)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy     from being enforced (CVE-2024-44296)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9636 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * chromium-browser: Use after free in ANGLE (CVE-2024-4558)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process     crash (CVE-2024-40789)

    * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40780)

    * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40779)

    * webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management (CVE-2024-40782)

    * webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)

    * webkitgtk: A malicious website may cause unexpected cross-origin behavior (CVE-2024-23271)

    * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820)

    * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2024-27851)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process     crash (CVE-2024-44185)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process     crash (CVE-2024-44244)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy     from being enforced (CVE-2024-44296)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, iOS 16.7.8 and     iPadOS 16.7.8, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, tvOS 17.5, visionOS 1.2. Processing a     file may lead to unexpected app termination or arbitrary code execution. (CVE-2024-27856)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0735-1 advisory.

    Update to version 2.46.6 (bsc#1236946, bsc#1234851):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54479: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54502: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54505: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-54508: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.

    Already fixed in previous releases:

    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54534: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0691-1 advisory.

    Update to version 2.46.6 (bsc#1236946):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.

    Already fixed in previous releases:

    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0638-1 advisory.

    Update to version 2.46.6 (bsc#1236946):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.

    Already fixed in previous releases:

    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0639-1 advisory.

    Update to version 2.46.6 (bsc#1236946):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.

    Already fixed in previous releases:

    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8180 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkit: malicious website may exfiltrate audio data cross-origin (CVE-2024-23254)

    * webkit: processing malicious web content prevents Content Security Policy from being enforced     (CVE-2024-23263)

    * webkit: maliciously crafted webpage may be able to fingerprint the user (CVE-2024-23280)

    * webkit: processing maliciously crafted web content prevents Content Security Policy from being enforced     (CVE-2024-23284)

    * chromium-browser: Use after free in ANGLE (CVE-2024-4558)

    * webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution (CVE-2024-40776)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process     crash (CVE-2024-40789)

    * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40780)

    * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40779)

    * webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management (CVE-2024-40782)

    * webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)

    * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820)

    * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838)

    * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2024-27851)

    * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)

    * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process     crash (CVE-2024-44185)

    * webkit: Processing maliciously crafted web content may lead to memory corruption (CVE-2024-54534)

    * webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution     (CVE-2024-27856)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 16.7.8. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 17.5. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
232750	RHEL 9 : webkit2gtk3 (RHSA-2024:9553)	Nessus	Red Hat Local Security Checks	critical
232632	RHEL 8 : webkit2gtk3 (RHSA-2024:9636)	Nessus	Red Hat Local Security Checks	critical
228060	Linux Distros Unpatched Vulnerability : CVE-2024-27856	Nessus	Misc.	high
216928	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2025:0735-1)	Nessus	SuSE Local Security Checks	critical
216736	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : webkit2gtk3 (SUSE-SU-2025:0691-1)	Nessus	SuSE Local Security Checks	high
216648	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2025:0638-1)	Nessus	SuSE Local Security Checks	high
216635	SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2025:0639-1)	Nessus	SuSE Local Security Checks	high
209157	RHEL 9 : webkit2gtk3 (RHSA-2024:8180)	Nessus	Red Hat Local Security Checks	critical
196911	Apple iOS < 16.7.8 Multiple Vulnerabilities (120898)	Nessus	Mobile Devices	high
196909	Apple iOS < 17.5 Multiple Vulnerabilities (120905)	Nessus	Mobile Devices	high

Detections

Analytics

CVE-2024-27856

high

Tenable Plugins

critical

critical

high

critical

high

high

high

critical

high

high