WebKit contains a use-after-free error in the 'ProcessingInstruction::removedFrom' function [WebCore/dom/ProcessingInstruction.cpp]. The issue is triggered when a ProcessingInstruction is removed from the document as the owner is removed, but the style resolver may not be updated. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.10.0, or higher, to address this vulnerability. An upgrade is required as there are no known workarounds.

Upgrade to Google Chrome version 21.0.1180.57 or higher for Mac and Linux or 21.0.1180.60 or higher for Windows and Chrome Frame, as they have been reported to fix this vulnerability.

• Security Tracker: 1028051
• CVE ID: 2012-2857 (see also: NVD)
• Secunia Advisory ID: 50105 50259 50337 52658 53471
• Bugtraq ID: 54749
• Related OSVDB ID: 84366 84367 84368 84369 84370 84371 84372 84373 84374 84375 84376 84378 84379 84380
• Vendor Specific News/Changelog Entry: http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.html
  http://security.gentoo.org/glsa/glsa-201208-03.xml
  https://bugs.webkit.org/show_bug.cgi?id=90803 [ Auth Req'd ]
• Packet Storm: http://packetstormsecurity.com/files/119897/Apple-Security-Advisory-2013-01-28-1.html
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT5671
  http://support.apple.com/kb/HT5766
  http://www.srware.net/forum/viewtopic.php?f=18&t=4269
  https://code.google.com/p/chromium/issues/detail?id=136235 [ Auth Req'd ]
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/123128
  http://trac.webkit.org/changeset/123528
  https://chromiumcodereview.appspot.com/10809085

• Arthur Gerkis