Yesterday, Apple issued new versions of the Safari browser that fix a binary planting vulnerability our company has reported to them in March this year under our then-effective disclosure policy. (See
Apple's advisory.)
In the last 20 days since the binary planting monster escaped to the wilderness, eager bug-hunters were focused on unsafe loading of libraries, and understandably so: free tools were made available, and instructions were published on how to use monitoring software like Sysinternals\' Process Monitor for detecting unsafe library loadings. As it turned out, tools + instructions + 20 days =
117 remotely exploitable vulnerabilities (at the time of this writing). The list is growing and will likely surpass our own list of
396 DLL planting and 127 EXE planting vulnerabilities at some time.