Bug 570349 (CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054)

A number of security vulnerabilities were reported in WebKit:

CVE-2010-0046: CSS format() argument memory corruption
https://bugs.webkit.org/show_bug.cgi?id=31815
http://trac.webkit.org/changeset/51727

CSS format() arguments were always treated as strings, which could result
in a crash or arbitrary code execution if an integer or other unexpected
type was used instead.


CVE-2010-0047: Call-after-free in HTMLObjectElement::renderFallBackContent (ZDI-CAN-579)
https://bugs.webkit.org/show_bug.cgi?id=31277
http://trac.webkit.org/changeset/50698

Changes to the style of an OBJECT element resulted in the creation of a new
frame, instead of re-using the existing frame. The existing frame would
then be prematurely destroyed, which could result in a crash or arbitrary
code execution.


CVE-2010-0048: Crash in XMLTokenizer::popCurrentNode if window.close() is called during parsing
https://bugs.webkit.org/show_bug.cgi?id=31576
http://trac.webkit.org/changeset/51962

The lifetime of an XML parser context was previously tied to its owning
document, which could result in a crash or arbitrary code execution if the
document is destroyed during parsing.


CVE-2010-0049: Use of free()d line boxes in mixed LTR/RTL text
https://bugs.webkit.org/show_bug.cgi?id=32749
http://trac.webkit.org/changeset/52527

When removing an empty text run, a linked list of text boxes may be
prematurely destroyed, which could result in a crash or arbitrary code
execution.


CVE-2010-0050: Crash at HTMLParser::popOneBlockCommon() after handling misnested residual style tags
https://bugs.webkit.org/show_bug.cgi?id=32567
http://trac.webkit.org/changeset/52073

A reference counting issue in the handling of incorrectly nested style tags
could result in a crash or arbitrary code execution.


CVE-2010-0052: Navigating to a cached page can result in accessing a destroyed HTMLInputElement
https://bugs.webkit.org/show_bug.cgi?id=32293
http://trac.webkit.org/changeset/51877

Returning to a page using Back/Forward navigation could result in a crash
or arbitrary code execution, if the page in question has a form element
with autocomplete disabled, then re-enables autocomplete for that form and
removes it from the page.


CVE-2010-0053: Crash due to double-destroy related to CSS run-in property
https://bugs.webkit.org/show_bug.cgi?id=31034
http://trac.webkit.org/changeset/50466

Continuations were destroyed before their anonymous children in some cases,
which could result in a crash or arbitrary code execution.


CVE-2010-0054: Use of stale HTMLImageElement pointer in JSHTMLFormElement::nameGetter
https://bugs.webkit.org/show_bug.cgi?id=34076
http://trac.webkit.org/changeset/53812
http://trac.webkit.org/changeset/53813
http://trac.webkit.org/changeset/54242


The destructor for HTML image input elements attempted to manipulate the
DOM of the containing document, which could result in a crash or arbitrary
code execution.