Description
The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | webkit | 1.2.7-0+squeeze1 | DSA-2188-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | webkitgtk +2 | 1.2.6-2.el6_0 | RHSA-2011:0177 |
Advisories 2
- RHSA-2011:0177 Red Hat Security Advisory: webkitgtk security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2188-1 webkit - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2011-0121 vendor-advisory
- http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.html
- 42648 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=667025
- ADV-2011-0216 vdb-entry
- https://bugs.webkit.org/show_bug.cgi?id=49883
- oval:org.mitre.oval:def:13953 vdb-entry signature
- 43086 third-party-advisory
- http://code.google.com/p/chromium/issues/detail?id=63866
- RHSA-2011:0177 vendor-advisory
- http://trac.webkit.org/changeset/72685/trunk/WebCore/css/CSSParser.cpp
- http://trac.webkit.org/changeset/72685
- DSA-2188 vendor-advisory
- GLSA-201012-01 vendor-advisory
- 45722 vdb-entry