diff --git a/src/insets/ChangeLog b/src/insets/ChangeLog
index 6326761330..62ce0ac2d5 100644
--- a/src/insets/ChangeLog
+++ b/src/insets/ChangeLog
@@ -1,3 +1,8 @@
+2006-09-21  Jean-Marc Lasgouttes  <lasgouttes@lyx.org>
+
+	* insettabular.C (doDispatch): do not modify cursor when iterating
+	over the cells to apply LFUN_EMPH and friends.
+
 2006-09-20  Jean-Marc Lasgouttes  <lasgouttes@lyx.org>
 
 	* insettabular.C (cutSelection): reset cursor when it is invalid.
diff --git a/src/insets/insettabular.C b/src/insets/insettabular.C
index a33d83ebe9..f78150cec0 100644
--- a/src/insets/insettabular.C
+++ b/src/insets/insettabular.C
@@ -728,27 +728,22 @@ void InsetTabular::doDispatch(LCursor & cur, FuncRequest & cmd)
 			row_type rs, re;
 			col_type cs, ce;
 			getSelection(cur, rs, re, cs, ce);
+			LCursor tmpcur = cur;
 			for (row_type i = rs; i <= re; ++i) {
 				for (col_type j = cs; j <= ce; ++j) {
 					// cursor follows cell:
-					cur.idx() = tabular.getCellNumber(i, j);
+					tmpcur.idx() = tabular.getCellNumber(i, j);
 					// select this cell only:
-					cur.pos() = 0;
-					cur.resetAnchor();
-					cur.pos() = cur.top().lastpos();
-					cur.setCursor(cur);
-					cur.setSelection();
-					cell(cur.idx())->dispatch(cur, cmd);
+					tmpcur.pit() = 0;
+					tmpcur.pos() = 0;
+					tmpcur.resetAnchor();
+					tmpcur.pit() = tmpcur.lastpit();
+					tmpcur.pos() = tmpcur.top().lastpos();
+					tmpcur.setCursor(tmpcur);
+					tmpcur.setSelection();
+					cell(tmpcur.idx())->dispatch(tmpcur, cmd);
 				}
 			}
-			// Restore original selection
-			cur.idx() = tabular.getCellNumber(rs, cs);
-			cur.pos() = 0;
-			cur.resetAnchor();
-			cur.idx() = tabular.getCellNumber(re, ce);
-			cur.pos() = cur.top().lastpos();
-			cur.setCursor(cur);
-			cur.setSelection();
 			break;
 		} else {
 			cell(cur.idx())->dispatch(cur, cmd);
diff --git a/status.14x b/status.14x
index 2c08d7825a..922b4c05f8 100644
--- a/status.14x
+++ b/status.14x
@@ -83,6 +83,10 @@ What's new
 
 - Fix a crash when selecting several cells in a tabular (bug 2630).
 
+- Fix a crash when deleting a multi-cell selection in a tabular.
+
+- Fix a crash when applying a font change to several cells in a tabular.
+
 - Fix a crash when searching for an inset and none is present.
 
 - Fix a crash when scrolling the document and the cursor is inside an
@@ -92,8 +96,6 @@ What's new
 
 - Fix a crash with change tracking in tables (bug 2600).
 
-- Fix a crash when deleting a multi-cell selection in a tabular.
-
 - Fix a crash when undoing super/subscript deletion (bug 2727).
 
 - Fix a crash when the cursor is in an empty script and the user