Three vulnerabilities have been reported in Apple iOS, which can be exploited by malicious code to bypass certain restrictions and malicious people to compromise a vulnerable device.

1) Two vulnerabilities in the CoreGraphics component exist due to use of vulnerable FreeType code.

For more information:
SA41738
SA45167

Successful exploitation allows execution of arbitrary code.

2) An invalid type conversion error in the use of IOMobileFrameBuffer queueing primitives can be exploited by code running as the user to bypass imposed restrictions and gain system privileges.

Solution
Apply iOS 4.2.9 Software Update for iPhone 4 (CDMA model) or iOS 4.3.4 Software Update for iPhone 3GS and iPhone 4 (GSM model), iPod touch (3rd generation) and later, and iPad.

Provided and/or discovered by
Disclosed in an exploit by comex.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apple:
http://support.apple.com/kb/HT4802
http://support.apple.com/kb/HT4803

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers