WebKit contains an integer overflow condition in the 'StyleElement::process' function [WebCore/dom/StyleElement.cpp] that is triggered as user-supplied input is not properly validated when handling style elements. With a specially crafted web page, a context-dependent attacker can cause a buffer overflow, allowing execution of arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.4.0, or higher, to address this vulnerability.

Upgrade to Google Chrome version 10.0.648.133, BlackBerry Device Software version 6.0.0.522, Apple Safari version 5.0.5, Apple iOS version 4.3.2, Apple iOS for iPhone 4 (CDMA) version 4.2.7, and Apple iTunes version 10.2.2, or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1025212
• CVE ID: 2011-1290 (see also: NVD)
• Secunia Advisory ID: 43735 43748 43782 43832 44151 44154 44207 44262
• Bugtraq ID: 46849
• ISS X-Force ID: 66052
• Related OSVDB ID: 72689
• VUPEN Advisory: ADV-2011-0645 [ Link is 404 ] ADV-2011-0654 [ Link is 404 ] ADV-2011-0671 [ Link is 404 ]
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=75712
  http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates.html
  http://www.blackberry.com/btsc/KB26132
  https://bugs.webkit.org/show_bug.cgi?id=56150 [ Auth Req'd ]
• Other Advisory URL: http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
  http://www.blackberry.com/btsc/KB26132
  http://www.debian.org/security/2011/dsa-2192
  http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
  http://www.zerodayinitiative.com/advisories/ZDI-11-104/
• Mail List Post: http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html
  http://lists.apple.com/archives/security-announce/2011//Apr/msg00001.html
  http://lists.apple.com/archives/security-announce/2011//Apr/msg00002.html
  http://seclists.org/fulldisclosure/2011/Apr/252
  http://seclists.org/fulldisclosure/2011/Apr/252
• Vendor Specific Advisory URL: http://support.apple.com/kb/HT4596
  http://support.apple.com/kb/HT4609
  http://www.debian.org/security/2011/dsa-2192
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/80787

• Vincenzo Iozzo - Zero Day Initiative (ZDI)
• Ralf Philipp Weinmann - Zero Day Initiative (ZDI)
• Willem Pinckaers - Zero Day Initiative (ZDI)