The iPhone OS AudioCodecs library contains a heap buffer overflow vulnerability while parsing maliciously crafted AAC or MP3 files. The vulnerability may be exploited by an attacker to execute arbitrary code in the context of an application using the vulnerable library. One attack vector are iPhone ringtones with malformed sample size table entries. It was successfully tested that iTunes uploads such malformed ringtones to the phone.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/81311/TKADV2009-007.txt
Source: https://packetstormsecurity.com/files/81311/Apple-iPhone-OS-AudioCodecs-Heap-Buffer-Overflow.html