WebKit contains a use-after-free error in the 'XSLTProcessor::transformToString' function [WebCore/xml/XSLTProcessorLibxslt.cpp] that is triggered when errors occur during stylesheet compilation. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.8.0, or higher, to address this vulnerability.

Upgrade to Google Chrome version 17.0.963.46 or higher, Apple iOS version 6 or higher, and Apple Safari version 6 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1026654
• CVE ID: 2011-3966 (see also: NVD)
• SCIP VulDB ID: 4615
• Secunia Advisory ID: 47938 48059 50058 50586 50618
• Bugtraq ID: 51911
• Related OSVDB ID: 78933 78934 78935 78936 78937 78938 78939 78940 78941 78942 78943 78944 78945 78947 78948 78949 78950 78951 78952
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=109716
  http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html
  http://security.gentoo.org/glsa/glsa-201202-01.xml
  https://bugs.webkit.org/show_bug.cgi?id=75978 [ Auth Req'd ]
• Mail List Post: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
• Vendor Specific Advisory URL: http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
  http://support.apple.com/kb/HT5400
  http://support.apple.com/kb/HT5503
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/105524

• Aki Helin - Oulu University Secure Programming Group