WebKit contains a use-after-free error in the 'SVGElementInstance::detach' function in WebCore/svg/SVGElementInstance.cpp when DETAILED DESCRIPTION. With a specially crafted SVG file, a context-dependent attacker can dereference already freed memory and execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.10.2 or higher to address this vulnerability.

Upgrade to Google Chrome version 22.0.1229.94 or higher and Google Chrome OS version 21.0.1180.92 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027644
• CVE ID: 2012-5112 (see also: NVD)
• Secunia Advisory ID: 50954 51079 51157 51162 53471
• Bugtraq ID: 55867
• Related OSVDB ID: 86150
• Vendor Specific Advisory URL: http://blog.chromium.org/2012/10/pwnium-2-results-and-wrap-up_10.html
  http://support.apple.com/kb/HT5567
  http://support.apple.com/kb/HT5568
  http://support.apple.com/kb/HT5766
• Vendor Specific News/Changelog Entry: http://googlechromereleases.blogspot.com/2012/10/stable-channel-update_6105.html
  http://www.gentoo.org/security/en/glsa/glsa-201210-07.xml
  https://bugs.webkit.org/show_bug.cgi?id=98851 [ Auth Req'd ]
  https://code.google.com/p/chromium/issues/detail?id=154987
• Mail List Post: http://seclists.org/bugtraq/2012/Nov/12
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/130855

• PinkiePie aka PwniePie