A use after free issue exists in WebKit's handling of DOM Range objects. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of DOM Range objects. References: Bugzilla: https://bugs.webkit.org/show_bug.cgi?id=28697 Trac: http://trac.webkit.org/changeset/59098 Acknowledgements: Red Hat would like to thank Drew Yao of Apple Product Security for responsibly reporting this issue. Upstream acknowledges Yaar Schnitman of Google Inc. as the original reporter.
Public via: [1] http://support.apple.com/kb/HT419