Just when you thought it was safe to hit up that sharapova_hott_champ.jpg some random dude sent you, a once-forgotten security hole from the depths of 2006 comes to claim your kernel.
A nearly 2-year-old bug in Mail allowed malicious types to include executable code in the resource fork of a file, without changing its MIME type. In other words, it says quacks like a .jpg but walks like a worm. Or slithers. In any case, the bug was fixed in a patch but has since re-emerged in Leopard; think about it as a 301st feature, a bonus added to the already overflowing cup that is OS 10.5. Our friends at Heise Security have demonstrated the bug and those vultures at the Register seized upon it like, well, you know, like vultures. In any case, until further notice, be aware of suspicious MIME types, and always check your hashes.
Leopard security bug puts Mail users at risk [El Register]