The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5468 advisory.

    The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2023-38133 YeongHyeon     Choi discovered that processing web content may disclose sensitive information. CVE-2023-38572 Narendra     Bhati discovered that a website may be able to bypass the Same Origin Policy. CVE-2023-38592 Narendra     Bhati, Valentino Dalla Valle, Pedro Bernardo, Marco Squarcina, and Lorenzo Veronese discovered that     processing web content may lead to arbitrary code execution. CVE-2023-38594 Yuhao Hu discovered that     processing web content may lead to arbitrary code execution. CVE-2023-38595 An anonymous researcher,     Jiming Wang, and Jikai Ren discovered that processing web content may lead to arbitrary code execution.
    CVE-2023-38597 Junsung Lee discovered that processing web content may lead to arbitrary code execution.
    CVE-2023-38599 Hritvik Taneja, Jason Kim, Jie Jeff Xu, Stephan van Schaik, Daniel Genkin, and Yuval Yarom     discovered that a website may be able to track sensitive user information. CVE-2023-38600 An anonymous     researcher discovered that processing web content may lead to arbitrary code execution. CVE-2023-38611     Francisco Alonso discovered that processing web content may lead to arbitrary code execution. For the     oldstable distribution (bullseye), these problems have been fixed in version 2.40.5-1~deb11u1. For the     stable distribution (bookworm), these problems have been fixed in version 2.40.5-1~deb12u1. We recommend     that you upgrade your webkit2gtk packages. For the detailed security status of webkit2gtk please refer to     its security tracker page at: https://security-tracker.debian.org/tracker/webkit2gtk

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5468-1 : webkit2gtk - security update

high Nessus Plugin ID 179393

Version 1.1

Version 1.0

Version 1.1 Jan 24, 2025, 9:25 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501242125
Version 1.0 Aug 7, 2023, 3:37 PM New Plugin Feed: 202308071537