WebKit contains a bad cast flaw in the 'SelectElement::setSelectedIndex' function [WebCore/dom/SelectElement.cpp]. The issue is triggered when firing an onchange event that changes the select from a menu list to a list box. With a specially crafted web page, a context-dependent attacker can corrupt memory to cause a denial of service or potentially execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.2.5, or higher, to address this vulnerability.

• CVE ID: 2010-1814 (see also: NVD)
• Secunia Advisory ID: 41328 41856 41871 42264 42314 43068 43086
• ISS X-Force ID: 61701
• Vendor Specific News/Changelog Entry: http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS [ Link is 404 ]
  http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
  http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049544.html
  http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049604.html
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
  https://bugs.webkit.org/show_bug.cgi?id=40828
  https://code.google.com/p/chromium/issues/detail?id=47086
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT4334
  http://www.ubuntu.com/usn/usn-1006-1
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/61709
• RedHat RHSA: https://rhn.redhat.com/errata/RHSA-2011-0177.html

• Csaba Osztrogonac - University of Szeged