Suresec Security Advisory - The malloc() function on Mac OS X insecurely trusts a debug variable, regardless of the fact that the calling application may be suid root. This can result in an arbitrary file being overwritten, which can be used to escalate privileges.
cdb59539bd347748b5b59524ac993ceffaf516ffabd88ddfebd8dcd9e1a43d1b