Description
Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by setting an unspecified property of an HTML tag that causes child elements to be freed and later accessed when an HTML error occurs, related to "recursion in certain DOM event handlers."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | kde4libs | 4:4.1.0-3+lenny1 | DSA-1868-1 |
| Debian 5.0 | kdelibs | 4:3.5.10.dfsg.1-0lenny2 | DSA-1867-1 |
| Debian 5.0 | qt4-x11 | 4.4.3-1+lenny1 | DSA-1988-1 |
| Debian 5.0 | webkit | 1.0.1-4+lenny2 | DSA-1950-1 |
| Debian 4.0 | kdelibs | 4:3.5.5a.dfsg.1-8etch2 | DSA-1867-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdelibs +2 | 6:3.5.4-22.el5_3 | RHSA-2009:1127 |
| RHEL 4 | kdelibs +1 | 6:3.3.1-14.el4 | RHSA-2009:1127 |
Advisories 5
- RHSA-2009:1127 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1988-1 qt4-x11 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1950-1 webkit - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1867-1 kdelibs - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1868-1 kde4libs - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-822-1 vendor-advisory
- http://support.apple.com/kb/HT3639
- 43068 third-party-advisory
- FEDORA-2009-8039 vendor-advisory
- MDVSA-2009:330 vendor-advisory
- ADV-2009-1621 vdb-entry
- ADV-2011-0212 vdb-entry
- oval:org.mitre.oval:def:11009 vdb-entry signature
- APPLE-SA-2009-06-08-1 vendor-advisory
- 35260 vdb-entry
- 20090608 Multiple Vendor WebKit Error Handling Use After Free Vulnerability third-party-advisory
- FEDORA-2009-8046 vendor-advisory
- ADV-2009-1522 vdb-entry
- 37746 third-party-advisory
- 1022345 vdb-entry
- 36790 third-party-advisory
- APPLE-SA-2009-06-17-1 vendor-advisory
- DSA-1950 vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- 35379 third-party-advisory
- 36062 third-party-advisory
- USN-857-1 vendor-advisory
- 36057 third-party-advisory
- FEDORA-2009-8049 vendor-advisory
- http://support.apple.com/kb/HT3613
- USN-836-1 vendor-advisory
- 54990 vdb-entry
- FEDORA-2009-8020 vendor-advisory