The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, macOS Sonoma 14.4. Processing web content may lead to a denial-of-service.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4,     Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, macOS Sonoma 14.4. Processing web content may lead to     a denial-of-service. (CVE-2024-54658)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0735-1 advisory.

    Update to version 2.46.6 (bsc#1236946, bsc#1234851):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54479: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54502: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54505: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-54508: Processing maliciously crafted web content may lead to an unexpected process crash.
    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.

    Already fixed in previous releases:

    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54534: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0691-1 advisory.

    Update to version 2.46.6 (bsc#1236946):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.

    Already fixed in previous releases:

    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0638-1 advisory.

    Update to version 2.46.6 (bsc#1236946):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.

    Already fixed in previous releases:

    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0639-1 advisory.

    Update to version 2.46.6 (bsc#1236946):

    - CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
    - CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
    - CVE-2025-24158: Processing web content may lead to a denial-of-service.
    - CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.

    Already fixed in previous releases:

    - CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.
    - CVE-2024-27856: Processing a file may lead to unexpected app termination or arbitrary code execution.
    - CVE-2024-54658: Processing web content may lead to a denial-of-service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.4. It is, therefore, affected by multiple vulnerabilities:

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4, visionOS     1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. Processing web content may lead to arbitrary code     execution. (CVE-2024-23226)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An     app may be able to modify protected parts of the file system. (CVE-2022-42816)

  - File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: File is the name     of an Open Source project. (CVE-2022-48554)

  - A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey     12.7.1, macOS Ventura 13.6.1. An app may be able to access user-sensitive data. (CVE-2023-42853)

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 17.4. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
231272	Linux Distros Unpatched Vulnerability : CVE-2024-54658	Nessus	Misc.	medium
216928	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2025:0735-1)	Nessus	SuSE Local Security Checks	critical
216736	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : webkit2gtk3 (SUSE-SU-2025:0691-1)	Nessus	SuSE Local Security Checks	high
216648	SUSE SLES15 Security Update : webkit2gtk3 (SUSE-SU-2025:0638-1)	Nessus	SuSE Local Security Checks	high
216635	SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2025:0639-1)	Nessus	SuSE Local Security Checks	high
215231	macOS 14.x < 14.4 Multiple Vulnerabilities (120895)	Nessus	MacOS X Local Security Checks	critical
191558	Apple iOS < 17.4 Multiple Vulnerabilities (120893)	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2024-54658

medium

Tenable Plugins

medium

critical

high

high

high

critical

critical