A memory corruption issue exists in WebKit's rendering of CSS-styled HTML content with multiple :after pseudo-selectors. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved rendering of HTML content. References: Bugzilla: https://bugs.webkit.org/show_bug.cgi?id=38001 Trac: http://trac.webkit.org/changeset/58201 Acknowledgements: Red Hat would like to thank Drew Yao of Apple Product Security for responsibly reporting this issue. Upstream acknowledges wushi of team509 as the original reporter.
Public via: [1] http://support.apple.com/kb/HT419