WebKit contains a flaw in the 'XMLDocumentParser::exitText' function in WebCore/xml/parser/XMLDocumentParser.cpp when attaching a leaf text node back to the document. This can cause a use-after-free in the 'WebCore::RenderObjectChildList::destroyLeftoverChildren' function. With a specially crafted XML document, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

The vendor has released a patch to address this vulnerability. There are no known workarounds or upgrades to correct this issue. Check the vendor advisory, changelog, or solution in the references section for details.

Upgrade to Google Chrome version 18.0.1025.168 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027001
• OVAL ID: 15397
• CVE ID: 2012-1521 (see also: NVD)
• Secunia Advisory ID: 48992 49075 49175 50058 50586 50618 51070
• Related OSVDB ID: 81643 81645 81646 81647
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=117110
  http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html
  http://www.gentoo.org/security/en/glsa/glsa-201205-01.xml
  http://www.ubuntu.com/usn/usn-1617-1/
  https://bugs.webkit.org/show_bug.cgi?id=80726 [ Auth Req'd ]
  https://hermes.opensuse.org/messages/14565591
• Mail List Post: http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
• Vendor Specific Advisory URL: http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
  http://support.apple.com/kb/HT5400
  http://support.apple.com/kb/HT5503
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/113670

• SkyLined - Google Chrome Security Team
• wushi - iDefense Labs VCP