The version of Apple iTunes running on the remote host is prior to 12.5.4 It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted website, to corrupt memory and execute     arbitrary code. (CVE-2016-4692, CVE-2016-7635,     CVE-2016-7652)

  - Multiple information disclosure vulnerabilities exist     in WebKit due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website, to disclose memory contents. (CVE-2016-4743,     CVE-2016-7656)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7586)

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit these vulnerabilities, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7587, CVE-2016-7589:, CVE-2016-7610,     CVE-2016-7611, CVE-2016-7639, CVE-2016-7640,     CVE-2016-7641, CVE-2016-7642, CVE-2016-7645,     CVE-2016-7646, CVE-2016-7648, CVE-2016-7649,     CVE-2016-7654)

  - An information disclosure vulnerability exists in WebKit     due to improper handling of JavaScript prompts. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7592)

  - An information disclosure vulnerability exists in WebKit     due to the use of uninitialized memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose memory contents. (CVE-2016-7598)

  - An information disclosure vulnerability exists that is     triggered when handling HTTP redirections. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7599)

  - A remote code execution vulnerability exists in WebKit     due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-7632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for webkit2gtk3 to version 2.18.0 fixes the following issues: These security issues were fixed :

  - CVE-2017-7039: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7018: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7030: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7037: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7034: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7055: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7056: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7064: An issue was fixed that allowed remote     attackers to bypass intended memory-read restrictions     via a crafted app (bsc#1050469).

  - CVE-2017-7061: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7048: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7046: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-2538: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1045460)

  - CVE-2017-2496: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2539: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2510: An issue was fixed that allowed remote     attackers to conduct Universal XSS (UXSS) attacks via a     crafted website that improperly interacts with pageshow     events.

  - CVE-2017-2365: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2366: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2373: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2363: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2362: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2354: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749).

  - CVE-2017-2355: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access and application     crash) via a crafted website (bsc#1024749)

  - CVE-2017-2356: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2371: An issue was fixed that allowed remote     attackers to launch popups via a crafted website     (bsc#1024749)

  - CVE-2017-2364: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2369: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2016-7656: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7635: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7654: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7639: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7645: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7652: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7641: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7632: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7599: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website that used     HTTP redirects (bsc#1020950)

  - CVE-2016-7592: An issue was fixed that allowed remote     attackers to obtain sensitive information via crafted     JavaScript prompts on a web site (bsc#1020950)

  - CVE-2016-7589: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7623: An issue was fixed that allowed remote     attackers to obtain sensitive information via a blob URL     on a website (bsc#1020950)

  - CVE-2016-7586: An issue was fixed that allowed remote     attackers to obtain sensitive information via a crafted     website (bsc#1020950) For other non-security fixes     please check the changelog.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-15 (WebKitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebKitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attack can use multiple vectors to execute arbitrary code or       cause a denial of service condition.
  Workaround :

    There is no known workaround at this time.

The version of Apple iOS running on the mobile device is prior to 10.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accessibility
  - Accounts
  - Audio
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreText
  - Disk Images
  - Find My iPhone
  - FontParser
  - Graphics Driver
  - ICU
  - Image Capture
  - ImageIO
  - IOHIDFamily
  - IOKit
  - Kernel
  - libarchive
  - Local Authentication
  - Mail
  - Media Player
  - Power Management
  - Profiles
  - Safari Reader
  - Security
  - SpringBoard
  - syslog
  - WebKit

This update for webkit2gtk3 to version 2.18.0 fixes the following issues :

These security issues were fixed :

  - CVE-2017-7039: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7018: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7030: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7037: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7034: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7055: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7056: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7064: An issue was fixed that allowed remote     attackers to bypass intended memory-read restrictions     via a crafted app (bsc#1050469).

  - CVE-2017-7061: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7048: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-7046: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1050469).

  - CVE-2017-2538: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1045460)

  - CVE-2017-2496: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2539: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website.

  - CVE-2017-2510: An issue was fixed that allowed remote     attackers to conduct Universal XSS (UXSS) attacks via a     crafted website that improperly interacts with pageshow     events.

  - CVE-2017-2365: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2366: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2373: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2363: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2362: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2350: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted website     (bsc#1024749)

  - CVE-2017-2354: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749).

  - CVE-2017-2355: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access and application     crash) via a crafted website (bsc#1024749)

  - CVE-2017-2356: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2017-2371: An issue was fixed that allowed remote     attackers to launch popups via a crafted website     (bsc#1024749)

  - CVE-2017-2364: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site     (bsc#1024749)

  - CVE-2017-2369: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1024749)

  - CVE-2016-7656: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7635: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7654: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7639: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7645: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7652: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7641: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7632: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7599: An issue was fixed that allowed remote     attackers to bypass the Same Origin Policy and obtain     sensitive information via a crafted web site that used     HTTP redirects (bsc#1020950)

  - CVE-2016-7592: An issue was fixed that allowed remote     attackers to obtain sensitive information via crafted     JavaScript prompts on a website (bsc#1020950)

  - CVE-2016-7589: An issue was fixed that allowed remote     attackers to execute arbitrary code or cause a denial of     service (memory corruption and application crash) via a     crafted website (bsc#1020950)

  - CVE-2016-7623: An issue was fixed that allowed remote     attackers to obtain sensitive information via a blob URL     on a website (bsc#1020950)

  - CVE-2016-7586: An issue was fixed that allowed remote     attackers to obtain sensitive information via a crafted     website (bsc#1020950)

For other non-security fixes please check the changelog.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The version of Apple iTunes installed on the remote Windows host is prior to 12.5.4. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted website, to corrupt memory and execute     arbitrary code. (CVE-2016-4692, CVE-2016-7635,     CVE-2016-7652)

  - Multiple information disclosure vulnerabilities exist     in WebKit due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website, to disclose memory contents. (CVE-2016-4743,     CVE-2016-7656)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7586)

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit these vulnerabilities, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7587, CVE-2016-7589:, CVE-2016-7610,     CVE-2016-7611, CVE-2016-7639, CVE-2016-7640,     CVE-2016-7641, CVE-2016-7642, CVE-2016-7645,     CVE-2016-7646, CVE-2016-7648, CVE-2016-7649,     CVE-2016-7654)

  - An information disclosure vulnerability exists in WebKit     due to improper handling of JavaScript prompts. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7592)

  - An information disclosure vulnerability exists in WebKit     due to the use of uninitialized memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose memory contents. (CVE-2016-7598)

  - An information disclosure vulnerability exists that is     triggered when handling HTTP redirections. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7599)

  - A remote code execution vulnerability exists in WebKit     due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-7632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update addresses the following vulnerabilities :

  -     [CVE-2016-7656](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7656),     [CVE-2016-7635](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7635),     [CVE-2016-7654](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7654),     [CVE-2016-7639](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7639),     [CVE-2016-7645](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7645),     [CVE-2016-7652](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7652),     [CVE-2016-7641](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7641),     [CVE-2016-7632](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7632),     [CVE-2016-7599](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7599),     [CVE-2016-7592](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7592),     [CVE-2016-7589](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7589),     [CVE-2016-7623](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7623),     [CVE-2016-7586](https://cve.mitre.org/cgi-bin/cvename.cg     i?name=CVE-2016-7586)

Additional fixes :

  - Create GLX OpenGL contexts using version 3.2 (core     profile) when available to reduce the memory consumption     on Mesa based drivers.

  - Improve memory pressure handler to reduce the CPU usage     on memory pressure situations.

  - Fix a regression in WebKitWebView title notify signal     emission that caused the signal to be emitted multiple     times.

  - Fix high CPU usage in the web process loading     hyphenation dictionaries. More user agent string     improvements to improve compatibility with several     websites.

  - Fix web process crash when closing the web view in X11.

  - Fix the build with OpenGL ES2 enabled.

  - Fix several crashes and rendering issues.

Translation updates :

  - German.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for webkit2gtk3 fixes the following issues: Update to version 2.18.5 :

  + Disable SharedArrayBuffers from Web API.

  + Reduce the precision of 'high' resolution time to 1ms.

  + bsc#1075419 - Security fixes: includes improvements to     mitigate the effects of Spectre and Meltdown     (CVE-2017-5753 and CVE-2017-5715). Update to version     2.18.4 :

  + Make WebDriver implementation more spec compliant.

  + Fix a bug when trying to remove cookies before a web     process is spawned.

  + WebKitWebDriver process no longer links to     libjavascriptcoregtk.

  + Fix several memory leaks in GStreamer media backend.

  + bsc#1073654 - Security fixes: CVE-2017-13866,     CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to     version 2.18.3 :

  + Improve calculation of font metrics to prevent     scrollbars from being shown unnecessarily in some cases.

  + Fix handling of null capabilities in WebDriver     implementation.

  + Security fixes: CVE-2017-13798, CVE-2017-13788,     CVE-2017-13803. Update to version 2.18.2 :

  + Fix rendering of arabic text.

  + Fix a crash in the web process when decoding GIF images.

  + Fix rendering of wind in Windy.com.

  + Fix several crashes and rendering issues. Update to     version 2.18.1 :

  + Improve performance of GIF animations.

  + Fix garbled display in GMail.

  + Fix rendering of several material design icons when     using the web font.

  + Fix flickering when resizing the window in Wayland.

  + Prevent default kerberos authentication credentials from     being used in ephemeral sessions.

  + Fix a crash when webkit_web_resource_get_data() is     cancelled.

  + Correctly handle touchmove and touchend events in     WebKitWebView.

  + Fix the build with enchant 2.1.1.

  + Fix the build in HPPA and Alpha.

  + Fix several crashes and rendering issues.

  + Security fixes: CVE-2017-7081, CVE-2017-7087,     CVE-2017-7089, CVE-2017-7090, CVE-2017-7091,     CVE-2017-7092, CVE-2017-7093, CVE-2017-7094,     CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,     CVE-2017-7099, CVE-2017-7100, CVE-2017-7102,     CVE-2017-7104, CVE-2017-7107, CVE-2017-7109,     CVE-2017-7111, CVE-2017-7117, CVE-2017-7120,     CVE-2017-7142.

  - Enable gold linker on s390/s390x on SLE15/Tumbleweed.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for webkit2gtk3 fixes the following issues :

Update to version 2.18.5 :

  + Disable SharedArrayBuffers from Web API.

  + Reduce the precision of 'high' resolution time to 1ms.

  + bsc#1075419 - Security fixes: includes improvements to     mitigate the effects of Spectre and Meltdown     (CVE-2017-5753 and CVE-2017-5715).

Update to version 2.18.4 :

  + Make WebDriver implementation more spec compliant.

  + Fix a bug when trying to remove cookies before a web     process is spawned.

  + WebKitWebDriver process no longer links to     libjavascriptcoregtk.

  + Fix several memory leaks in GStreamer media backend.

  + bsc#1073654 - Security fixes: CVE-2017-13866,     CVE-2017-13870, CVE-2017-7156, CVE-2017-13856.

Update to version 2.18.3 :

  + Improve calculation of font metrics to prevent     scrollbars from being shown unnecessarily in some cases.

  + Fix handling of null capabilities in WebDriver     implementation.

  + Security fixes: CVE-2017-13798, CVE-2017-13788,     CVE-2017-13803.

Update to version 2.18.2 :

  + Fix rendering of arabic text.

  + Fix a crash in the web process when decoding GIF images.

  + Fix rendering of wind in Windy.com.

  + Fix several crashes and rendering issues.

Update to version 2.18.1 :

  + Improve performance of GIF animations.

  + Fix garbled display in GMail.

  + Fix rendering of several material design icons when     using the web font.

  + Fix flickering when resizing the window in Wayland.

  + Prevent default kerberos authentication credentials from     being used in ephemeral sessions.

  + Fix a crash when webkit_web_resource_get_data() is     cancelled.

  + Correctly handle touchmove and touchend events in     WebKitWebView.

  + Fix the build with enchant 2.1.1.

  + Fix the build in HPPA and Alpha.

  + Fix several crashes and rendering issues.

  + Security fixes: CVE-2017-7081, CVE-2017-7087,     CVE-2017-7089, CVE-2017-7090, CVE-2017-7091,     CVE-2017-7092, CVE-2017-7093, CVE-2017-7094,     CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,     CVE-2017-7099, CVE-2017-7100, CVE-2017-7102,     CVE-2017-7104, CVE-2017-7107, CVE-2017-7109,     CVE-2017-7111, CVE-2017-7117, CVE-2017-7120,     CVE-2017-7142.

  - Enable gold linker on s390/s390x on SLE15/Tumbleweed.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 10.0.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted website, to corrupt memory and execute     arbitrary code. (CVE-2016-4692, CVE-2016-7635,     CVE-2016-7652)

  - Multiple information disclosure vulnerabilities exist     in WebKit due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website, to disclose memory contents. (CVE-2016-4743,     CVE-2016-7656)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7586)

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit these vulnerabilities, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7587, CVE-2016-7589:, CVE-2016-7610,     CVE-2016-7611, CVE-2016-7639, CVE-2016-7640,     CVE-2016-7641, CVE-2016-7642, CVE-2016-7645,     CVE-2016-7646, CVE-2016-7648, CVE-2016-7649,     CVE-2016-7654)

  - An information disclosure vulnerability exists in WebKit     due to improper handling of JavaScript prompts. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7592)

  - An information disclosure vulnerability exists in WebKit     due to the use of uninitialized memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose memory contents. (CVE-2016-7598)

  - An information disclosure vulnerability exists that is     triggered when handling HTTP redirections. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7599)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input and     blob URLs. An unauthenticated, remote attacker can     exploit this, via a specially crafted blob URL, to     disclose user information. (CVE-2016-7623)

  - A remote code execution vulnerability exists in WebKit     due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-7632)

  - A cross-site scripting (XSS) vulnerability exists in     Safari Reader due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, by convincing a user to follow a     specially crafted link, to execute arbitrary script code     in a user's browser session. (CVE-2016-7650)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3191-1 advisory.

    A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user     were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related     to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary     code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Safari prior to 10.0.2 are affected by multiple vulnerabilities :

 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists because the Safari Reader feature does not properly validate certain input before returning it to users. This may allow a context-dependent attacker to execute arbitrary script code in a user's browser session within the trust relationship between their browser and any website.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can potentially disclose memory contents. 
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can potentially disclose certain user information.
 - A use-after-free error exists in the handling of 'RenderObject' objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of 'HTMLLabelElement' objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when handling JavaScript prompts. With a specially crafted web page, a context-dependent attacker can disclose unspecified user information.
 - A flaw exists related to use of uninitialized memory. With a specially crafted web page, a context-dependent attacker can potentially disclose memory contents.
 - A flaw exists that is triggered when handling HTTP redirects. With specially crafted web contents, a context-dependent attacker can disclose unspecified user information.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.

ID	Name	Product	Family	Published	Updated	Severity
95825	Apple iTunes < 12.5.4 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	12/14/2016	11/13/2019	high
104428	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2017:2933-1)	Nessus	SuSE Local Security Checks	11/7/2017	1/6/2021	high
100675	GLSA-201706-15 : WebKitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/8/2017	1/11/2021	high
95826	Apple iOS < 10.2 Multiple Vulnerabilities	Nessus	Mobile Devices	12/14/2016	9/4/2024	high
104526	openSUSE Security Update : webkit2gtk3 (openSUSE-2017-1268)	Nessus	SuSE Local Security Checks	11/13/2017	1/19/2021	high
95824	Apple iTunes < 12.5.4 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	12/14/2016	11/13/2019	high
96676	Fedora 25 : webkitgtk4 (2017-b015aa1d33)	Nessus	Fedora Local Security Checks	1/23/2017	1/6/2021	high
106370	SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2018:0219-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	1/26/2018	9/10/2019	high
106549	openSUSE Security Update : webkit2gtk3 (openSUSE-2018-118) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2/1/2018	1/19/2021	high
95919	macOS : Apple Safari < 10.0.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	12/16/2016	1/7/2020	high
96680	Fedora 24 : webkitgtk4 (2017-d317f6fb61)	Nessus	Fedora Local Security Checks	1/23/2017	1/6/2021	high
97048	Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3191-1)	Nessus	Ubuntu Local Security Checks	2/7/2017	8/27/2024	high
9864	Safari < 10.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	1/12/2017	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

medium