CVE-2010-1806

Vulnerabilidad de uso después de la liberación en Apple Safari v4.x anteriores a v4.1.2 y v5.x anteriores a v5.0.2 , permite a atacantes remotos ejecutar código o provacar una denegación de servicio (caída de la aplicación) a través del acondicionamiento del estilo de un elemento, relacionado con objeto de punteros.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the library's support of an element containing the run-in property. When a block box is appended as the sibling of a run-in box, the run-in box will be promoted to the first inline box. This implies that the first inline box will be destroyed. Later when the application attempts to destroy this element, it will access memory that has been freed. If an attacker can substitute an alternate type in the element's place, the attacker will have code execution under the context of the application.