移动设备上正在运行的 iOS 版本低于 8.4.1。
因此，它受到以下组件中的漏洞的影响：

  - Air Traffic
  - AppleFileConduit
  - 备份
  - bootp
  - CFPreferences
  - 证书 UI
  - CloudKit
  - 代码签名
  - CoreMedia 回放
  - CoreText
  - DiskImages
  - FontParser
  - IOHIDFamily
  - IOKit
  - ImageIO
  - 内核
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - 位置框架
  - MSVDX 驱动程序
  - MobileInstallation
  - Office Viewer
  - QL Office
  - Safari
  - Sandbox_profiles
  - UIKit WebView
  - Web
  - WebKit

在 WebKitGTK+ Web 和 JavaScript 引擎中发现大量安全问题。如果用户受到诱骗查看恶意网站，远程攻击者可利用与网页浏览器安全有关的各种问题，包括跨站脚本攻击、拒绝服务攻击和任意代码执行。

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

遠端 Mac OS X 主機上安裝的 Apple Safari 版本比 6.2.8 / 7.1.8 / 8.0.8 舊。因此，該應用程式受到以下弱點影響：

  - 存在一個不明瑕疵，會讓攻擊者得以利用特製網頁來偽造 UI 元素。
    (CVE-2015-3729)

  - WebKit 中存有多個記憶體損毀瑕疵，這是因為不當驗證使用者提供的輸入所致。攻擊者可惡意利用這些瑕疵，使用特製網頁來執行任意程式碼。(CVE-2015-3730、CVE-2015-3731 CVE-2015-3732、CVE-2015-3733、CVE-2015-3734、CVE-2015-3735、CVE-2015-3736、CVE-2015-3737、CVE-2015-3738、CVE-2015-3739、CVE-2015-3740、CVE-2015-3741、CVE-2015-3742、CVE-2015-3743、CVE-2015-3744、CVE-2015-3745、CVE-2015-3746、CVE-2015-3747、CVE-2015-3748、CVE-2015-3749)

  - WebKit 中存有一個安全性原則繞過弱點，這與內容安全性原則報告要求的處理有關。攻擊者可利用此弱點繞過 HTTP Strict Transport Security 原則。(CVE-2015-3750)

  - WebKit 中存有一個安全性原則繞過弱點，允許網站違反內容安全性原則指示詞，使用視訊控制項來載入物件元素中巢狀的影像。(CVE-2015-3751)

  - WebKit 中存有一個資訊洩漏弱點，這與 cookie 新增至內容安全性原則報告要求的方式有關，會導致 cookie 被洩漏至跨來源要求。此外，正常瀏覽期間設定的 cookie 會在私密瀏覽時被傳送出去。(CVE-2015-3752)

  - WebKit Canvas 元件中存有一個資訊洩漏弱點，當使用重新導向至 data:image 資源的 URL 來呼叫影像時，就會觸發此弱點。攻擊者可利用此弱點，透過惡意網站洩漏跨來源的影像資料。(CVE-2015-3753)

  - WebKit 頁面載入中存在一個資訊洩漏弱點，在私密瀏覽模式下輸入的 HTTP 驗證認證在快取時會被傳遞至正常瀏覽，從而導致使用者的私密瀏覽歷程記錄遭洩漏。(CVE-2015-3754)

  - WebKit 處理程序模型中有一個瑕疵，允許惡意網站顯示任意 URL，進而導致使用者介面偽造。(CVE-2015-3755)

此更新可解決下列弱點：

- CVE-2015-1120

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1120)

- CVE-2015-1076

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1076)

- CVE-2015-1071

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1071)

- CVE-2015-1081

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1081)

- CVE-2015-1122

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1122)

- CVE-2015-1155

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1155)

- CVE-2014-1748

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1748)

- CVE-2015-3752

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3752)

- CVE-2015-5809

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5809)

- CVE-2015-5928

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5928)

- CVE-2015-3749

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3749)

- CVE-2015-3659

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3659)

- CVE-2015-3748

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3748)

- CVE-2015-3743

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3743)

- CVE-2015-3731

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3731)

- CVE-2015-3745

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3745)

- CVE-2015-5822

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5822)

- CVE-2015-3658

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3658)

- CVE-2015-3741

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3741)

- CVE-2015-3727

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3727)

- CVE-2015-5801

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5801)

- CVE-2015-5788

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5788)

- CVE-2015-3747

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3747)

- CVE-2015-5794

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5794)

- CVE-2015-1127

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1127)

- CVE-2015-1153

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1153)

- CVE-2015-1083

(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1083)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

行動裝置執行的 iOS 版本比 8.4.1 舊。
因此受到下列元件中的弱點影響：

  - Air Traffic
  - AppleFileConduit
  - 備份
  - bootp
  - CFPreferences
  - Certificate UI
  - CloudKit
  - 程式碼簽署
  - CoreMedia Playback
  - CoreText
  - DiskImages
  - FontParser
  - IOHIDFamily
  - IOKit
  - ImageIO
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - Location Framework
  - MSVDX 驅動程式
  - MobileInstallation
  - Office Viewer
  - QL Office
  - Safari
  - Sandbox_profiles
  - UIKit View
  - Web
  - WebKit

在 WebKitGTK+ Web 和 JavaScript 引擎中發現大量安全性問題。如果使用者遭到誘騙而檢視惡意網站，遠端攻擊者可利用多個與網頁瀏覽器安全性相關的問題，包括跨網站指令碼攻擊、拒絕服務攻擊和任意程式碼執行等。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The remote host is running a version of iOS that is prior to version 8.4.1 and the following components contain vulnerabilities :

 - Air Traffic 
 - AppleFileConduit 
 - Backup 
 - bootp 
 - CFPreferences 
 - Certificate UI 
 - CloudKit 
 - Code Signing 
 - CoreMedia Playback 
 - CoreText 
 - DiskImages 
 - FontParser 
 - IOHIDFamily 
 - IOKit 
 - ImageIO 
 - Kernel 
 - Libc 
 - Libinfo 
 - libpthread 
 - libxml2 
 - libxpc 
 - Location Framework 
 - MSVDX Driver 
 - MobileInstallation 
 - Office Viewer 
 - QL Office 
 - Safari 
 - Sandbox_profiles 
 - UIKit WebView 
 - Web 
 - WebKit 


Versions of Safari prior to 6.2.8 / 7.1.8 / 8.0.8 are reportedly affected by the following vulnerabilities :

 - An unspecified flaw exists that allows an attacker to spoof UI elements by using crafted web pages. (CVE-2015-3729)
 - Multiple memory corruption flaws exist in WebKit due to improper validation of user-supplied input. An attacker can exploit these, by using a crafted web page, to execute arbitrary code. (CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749)
 - A security policy bypass vulnerability exists in WebKit related to handling Content Security Policy report requests. An attacker can exploit this to bypass the HTTP Strict Transport Security policy. (CVE-2015-3750)
 - A security policy bypass vulnerability exists in WebKit that allows websites to use video controls to load images nested in object elements in violation of Content Security Policy directives. (CVE-2015-3751)
 - An information disclosure vulnerability exists in WebKit related to how cookies are added to Content Security Policy report requests, which results in cookies being exposed to cross-origin requests. Also, cookies set during regular browsing are sent during private browsing. (CVE-2015-3752)
 - An information disclosure vulnerability exists in the WebKit Canvas component when images are called using URLs that redirect to a data:image resource. An attacker, using a malicious website, can exploit this to disclose image data cross-origin. (CVE-2015-3753)
 - An information disclosure vulnerability exists in WebKit page loading where the caching of HTTP authentication credentials entered in private browsing mode were carried over into regular browsing, resulting in a user's private browsing history being exposed. (CVE-2015-3754)
 - A flaw in the WebKit process model allows a malicious website to display an arbitrary URL, which can allow user interface spoofing. (CVE-2015-3755)

Versions of iTunes earlier than 12.3 are affected by multiple vulnerabilities which include :

 - A flaw exists in Microsoft Foundation Class's handling of library loading due to the use of a fixed path.  An attacker can place a custom version of the file or library in the path, and the program will load it before the legitimate version.  Thus, an attacker can leverage this flaw to execute custom code. (CVE-2010-3190)
 - International Components for Unicode for C/C++ (ICU4C) contains several flaws.  An overflow condition exists in the resolveImplicitLevels() function in 'ubidi.c', which is triggered as user-supplied input is not properly validated. Additionally, an integer truncation flaw exists in the same function in 'ubidi.c'.   Either flaw may allow an attacker to crash an application linked against the library or potentially execute arbitrary code. (CVE-2014-8146, CVE-2014-8147, CVE-2015-5922)
 - A flaw exists in CoreText that is triggered as user-supplied input is not properly validated when handling text and font files. This may allow a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2015-1157, CVE-2015-5874, CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, CVE-2015-5755, CVE-2015-5761)
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-1152, CVE-2015-1153, CVE-2015-3730, CVE-2015-3731, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5796, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5808, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5821, CVE-2015-5822, CVE-2015-5823)
 - An unspecified flaw exists that is triggered during the handling of network connection redirects. This may allow a remote man-in-the-middle attacker to gain access to hashed SMB credential information. (CVE-2015-5920)

Versions of Apple TV earlier than 7.2.1 are unpatched for vulnerabilities in the following components :

 - bootp
 - CFPreferences
 - CloudKit
 - Code Signing
 - CoreMedia Playback
 - CoreText
 - DiskImages
 - FontParser
 - ImageIO
 - IOHIDFamily
 - IOKit
 - Kernel
 - Libc
 - Libinfo
 - libpthread
 - libxml2
 - libxpc
 - libxslt
 - Location Framework
 - Office Viewer
 - QL Office
 - Sandbox_profiles
 - WebKit

ID	Name	Product	Family	Published	Updated	Severity
85407	Apple iOS < 8.4.1 多个漏洞	Nessus	Mobile Devices	8/14/2015	9/4/2024	high
90094	Ubuntu 14.04 LTS：WebKitGTK+ 漏洞 (USN-2937-1)	Nessus	Ubuntu Local Security Checks	3/22/2016	8/27/2024	high
85446	Mac OS X：Apple Safari < 6.2.8 / 7.1.8 / 8.0.8 多個弱點	Nessus	MacOS X Local Security Checks	8/17/2015	7/14/2018	medium
90220	Fedora 24：webkitgtk-2.4.10-1.fc24 (2016-a4fcb02d6b)	Nessus	Fedora Local Security Checks	3/28/2016	1/11/2021	medium
85407	Apple iOS < 8.4.1 多個弱點	Nessus	Mobile Devices	8/14/2015	9/4/2024	high
90094	Ubuntu 14.04 LTS：WebKitGTK+ 弱點 (USN-2937-1)	Nessus	Ubuntu Local Security Checks	3/22/2016	8/27/2024	high
8978	Apple iOS < 8.4.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	10/14/2015	3/6/2019	critical
8949	Safari < 6.2.8 / 7.1.8 / 8.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	10/1/2015	3/6/2019	high
8958	iTunes for Windows < 12.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	10/23/2015	3/6/2019	high
9333	Apple TV < 7.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	5/27/2016	3/6/2019	low

Detections

Analytics

Plugins Search

high

high

medium

medium

high

high

critical

high

high

low