OSVDB ID: 86149

Title: WebKit SVGElementInstance::detach Function Use-after-free Arbitrary Code Execution

Info

Disclosure
Oct 09, 2012

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Oct 09, 2012

Description

 WebKit contains a use-after-free error in the 'SVGElementInstance::detach' function in WebCore/svg/SVGElementInstance.cpp when DETAILED DESCRIPTION. With a specially crafted SVG file, a context-dependent attacker can dereference already freed memory and execute arbitrary code.

Classification

 Location: Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Private
Disclosure: Vendor Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

 It has been reported that this issue has been fixed. Upgrade to version 1.10.2 or higher to address this vulnerability. Upgrade to Google Chrome version 22.0.1229.94 or higher and Google Chrome OS version 21.0.1180.92 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Google, Inc.

Chrome

 22.0.1229.92

Chrome OS

 21.0.1183.89

webkit.org

WebKitGTK+

 1.10.1

Apple Inc.

iTunes

 11.0.2
11.0.3
10.0.2

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/86149