WebKit contains a use-after-free error in the 'HTMLParser::handleResidualStyleCloseTagAcrossBlocks' function in WebCore/html/HTMLParser.cpp when handling misnested residual style tags. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.2.0, or higher, to address this vulnerability.

Upgrade to Apple Safari version 4.0.5 or higher, as it has been reported to fix this vulnerability. The vulnerability may also have been silently fixed in Google Chrome version 4.0.249.78. An upgrade is required as there are no known workarounds.

Unknown or Incomplete

• Security Tracker: 1023708
• Exploit Database: 12425
• CVE ID: 2010-0050 (see also: NVD)
• Bugtraq ID: 38671 38685
• Secunia Advisory ID: 39091 39094 40257 40557 41856 43068
• ISS X-Force ID: 56836
• OVAL ID: 7587
• VUPEN Advisory: ADV-2010-2722 [ Link is 404 ] ADV-2011-0212 [ Link is 404 ] ADV-2011-0552 [ Link is 404 ]
• Mail List Post: http://attrition.org/pipermail/vim/2010-April/002338.html
  http://attrition.org/pipermail/vim/2010-April/002343.html
  http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
  http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html
  http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
  http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html
  http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041436.html
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
  http://seclists.org/bugtraq/2010/Mar/141
• Vendor Specific Advisory URL: http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044023.html
  http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044031.html
  http://www.ubuntu.com/usn/usn-1006-1
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
  http://support.apple.com/kb/HT4070
  http://support.apple.com/kb/HT4225
  https://admin.fedoraproject.org/updates/qt-4.6.2-8.fc11
  https://admin.fedoraproject.org/updates/qt-4.6.2-8.fc12
  https://bugs.webkit.org/show_bug.cgi?id=32567 [ Auth Req'd ]
  https://bugzilla.redhat.com/show_bug.cgi?id=570349#c8
  https://code.google.com/p/chromium/issues/detail?id=30525
• Vendor Specific Solution URL: http://src.chromium.org/viewvc/chrome?view=rev&revision=34781
  http://trac.webkit.org/changeset/52073
• Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
  http://www.ubuntu.com/usn/USN-1006-1
  http://www.zerodayinitiative.com/advisories/ZDI-10-031

• wushi - Zero Day Initiative (ZDI)