Description
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | chromium-browser | 6.0.472.63~r59945-5+squeeze4 | DSA-2192-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qtwebkit-source | No fix yet | — |
Advisories 1
- DSA-2192-1 chromium-browser - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2011-0654 vdb-entry
- http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates.html
- 44151 third-party-advisory
- 46849 vdb-entry
- 1025212 vdb-entry
- http://support.apple.com/kb/HT4596
- 71182 vdb-entry
- DSA-2192 vendor-advisory
- APPLE-SA-2011-04-14-3 vendor-advisory
- APPLE-SA-2011-04-14-2 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-104
- http://www.blackberry.com/btsc/KB26132
- ADV-2011-0984 vdb-entry
- ADV-2011-0645 vdb-entry
- http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
- 43782 third-party-advisory
- http://support.apple.com/kb/HT4607
- ADV-2011-0671 vdb-entry
- APPLE-SA-2011-04-14-1 vendor-advisory
- http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
- 43748 third-party-advisory
- 20110414 ZDI-11-104: (Pwn2Own) Webkit CSS Text Element Count Remote Code Execution Vulnerability mailing-list
- 44154 third-party-advisory
- google-webkit-style-code-execution(66052) vdb-entry
- 43735 third-party-advisory