Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.

Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted message.

Emmanuel Bouillon reported a memory corruption flaw in CUPS daemon. A specially-crafted IPP request can cause daemon to crash or, possibly, execute arbitrary code.

Acknowledgements:

Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting this issue.