WebKit contains a typecasting flaw in the 'FrameView::scrollToAnchor' function in WebCore/page/FrameView.cpp. With a specially crafted web page, a context-dependent attacker can corrupt memory to cause a denial of service or potentially execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.2.7, or higher, to address this vulnerability.

Upgrade to version 8.0.552.237 (Chrome), 8.0.552.344 (Chrome OS) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• OVAL ID: 14662
• CVE ID: 2011-0136 (see also: NVD) 2011-0482 (see also: NVD)
• Secunia Advisory ID: 42850 42951 43398 43582 43688 43692 44583 45694
• Bugtraq ID: 45788
• ISS X-Force ID: 64673
• Related OSVDB ID: 71545
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=68178
  http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS [ Link is 404 ]
  http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html
  http://lists.debian.org/debian-security-announce/2011/msg00055.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054157.html
  https://bugs.meego.com/show_bug.cgi?id=14565
  https://bugs.webkit.org/show_bug.cgi?id=51718 [ Auth Req'd ]
  https://hermes.opensuse.org/messages/8394137
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT4554
  http://support.apple.com/kb/HT4564
  http://support.apple.com/kb/HT4566
  http://www.ubuntu.com/usn/usn-1195-1/
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/74779
• Other Advisory URL: http://www.srware.net/forum/viewtopic.php?f=18&t=2054

• Sergey Glazunov