Integer overflow

Integer underflow in the HTMLFormElement::removeFormElement function in html/HTMLFormElement.cpp in WebCore in WebKit in Google Chrome before 11.0.696.65 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted HTML document...

CVE-2011-1795

CVE-2011-1795 describes an integer underflow in WebKit’s WebCore HTMLFormElement::removeFormElement, exposed in Google Chrome prior to 11.0.696.65. A crafted HTML document containing a FORM element could remotely crash the app or cause other unspecified impact. Affected software is Google Chrome ...