The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c6f03ea6-12de-11ef-83d8-4ccc6adda413 advisory.

  - Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to     potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-2625)

  - Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to     perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2024-2626)

  - Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-2885)

  - Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute     arbitrary code via a crafted HTML page. (Chromium security severity: High) (CVE-2024-2887)

  - Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote     attacker who had compromised the GPU process to potentially perform a sandbox escape via specific UI     gestures. (Chromium security severity: High) (CVE-2024-3157)

  - Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to     perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3159)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-3516)

  - Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: Medium) (CVE-2024-3837)

  - Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (Chromium security     severity: Medium) (CVE-2024-3839)

  - Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2024-3840)

  - Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3914)

  - Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2024-4058)

  - Use after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-4060)

  - Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-4331)

  - Use after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-4368)

  - Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: High) (CVE-2024-4671)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

FreeBSD : qt6-webengine -- Multiple vulnerabilities (c6f03ea6-12de-11ef-83d8-4ccc6adda413)

critical Nessus Plugin ID 197096

Version 1.1

Version 1.0

Version 1.1 May 17, 2024, 10:54 AM CVSS metrics ("CVSSv3 score" set to 9.6) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2024-3837" to "CVE-2024-4671") Plugin Feed: 202405171054
Version 1.0 May 16, 2024, 12:59 AM New Plugin Feed: 202405160059