WebKit contains a use-after-free error as WebKitLoseContext is not notified of WebGL rendering context being removed. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 1.4.0, or higher, to address this vulnerability.

Upgrade Google Chrome to version 10.0.648.127 or higher and SRWare Iron to version 10.0.650.0 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• OVAL ID: 14089
• CVE ID: 2011-1201 (see also: NVD)
• Secunia Advisory ID: 43683 43745
• Bugtraq ID: 46785
• ISS X-Force ID: 65965
• Related OSVDB ID: 72472 72473 72474 72475 72476 72477 72478 72479 72480 72481 72482 72483 72484 72485 72486 72487 72488 72490 72491 72492 72493 72494
• VUPEN Advisory: ADV-2011-0628 [ Link is 404 ]
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=73196
  http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html
  https://bugs.webkit.org/show_bug.cgi?id=54679 [ Auth Req'd ]
• Vendor Specific Solution URL: http://trac.webkit.org/changeset/78921
• Other Advisory URL: http://www.srware.net/forum/viewtopic.php?f=18&t=2270

• Sergey Glazunov