WebKit contains a use-after-free error that is triggered as SVGElementInstance::m_useElement is not cleared when a <use> element is removed. With a specially crafted SVG file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.4.0, or higher, to address this vulnerability.

Upgrade to version 8.0.552.237 (Chrome), 8.0.552.344 (Chrome OS) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• OVAL ID: 14191
• CVE ID: 2011-0135 (see also: NVD) 2011-0478 (see also: NVD)
• Secunia Advisory ID: 42850 42951 43582
• Bugtraq ID: 45788
• ISS X-Force ID: 64669
• Related OSVDB ID: 71546
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=67363
  http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html
  https://bugs.meego.com/show_bug.cgi?id=14561
  https://bugs.webkit.org/show_bug.cgi?id=51486 [ Auth Req'd ]
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT4554
  http://support.apple.com/kb/HT4564
  http://support.apple.com/kb/HT4566
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/74636
• Other Advisory URL: http://www.srware.net/forum/viewtopic.php?f=18&t=2054

• miaubiz
• Anonymous