WebKit contains a flaw that allows a universal cross-site scripting (UXSS) attack. The issue exists because DOMWindow::setLocation does not understand that DOMWindow can be inactive, which allows using contentWindow.eval to construct a function with the context of the inactive window. With a specially crafted web page, a context-dependent attacker can execute arbitrary script code in context of another domain.

It has been reported that this issue has been fixed. Upgrade to version 1.4.1, or higher, to address this vulnerability.

• CVE ID: 2011-2342 (see also: NVD) 2011-3243 (see also: NVD)
• Secunia Advisory ID: 44829 46377
• Bugtraq ID: 48129
• ISS X-Force ID: 67904
• Related OSVDB ID: 72791 76319 76320 76321 76322 76323 76324 76325 76326 76327 76328 76329 76330 76331 76332 76333 76334 76335 76336 76337 76338 76339 76340 76341 76342 76343 76344 76345 76346 76347 76348 76349 76350 76351 76352 76354
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=83743
  http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
  http://support.apple.com/kb/HT5000
  https://bugs.webkit.org/show_bug.cgi?id=62057 [ Auth Req'd ]
• Mail List Post: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
  http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html
  http://seclists.org/bugtraq/2011/Oct/73
  http://seclists.org/bugtraq/2011/Oct/78
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT4999
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/88071

• Sergey Glazunov