WebKit contains an overflow condition in the 'CSSParser::addProperty' function in css/CSSParser.cpp when DETAILEDCONDITION. With a specially crafted web page, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

The vendor has released a patch to address this vulnerability. There are no known workarounds or upgrades to correct this issue. Check the vendor advisory, changelog, or solution in the references section for details.

Upgrade to Google Chrome version 16.0.912.63 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1026774
• OVAL ID: 14579
• CVE ID: 2011-3909 (see also: NVD)
• Secunia Advisory ID: 47231 47445 48274 48288 48377
• Related OSVDB ID: 77706 77707 77708 77709 77710 77712 77713 77714 77715 77716 77717 77718 77719 77720
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=101010
  http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html
  http://security.gentoo.org/glsa/glsa-201201-03.xml
  https://bugs.webkit.org/show_bug.cgi?id=70540 [ Auth Req'd ]
• Mail List Post: http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html
  http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html
  http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5190
  http://support.apple.com/kb/HT5191
  http://support.apple.com/kb/HT5192
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/98374

• scarybeasts - Google Chrome Security Team