The vulnerability lies in the way Mail handles image attachments. An attacker could take executable code and rename it as a .jpg file. Mail would then run the code without the user even being aware that an application had been started.
This could allow an attacker to distribute malicious code to users disguised as an image attachment.
Heise Security said that, while the unpatched vulnerability is unique to Apple's latest operating system, it is hardly new.
Apple patched the same flaw for Leopard's predecessor, MacOS 10.4 Tiger, in early 2006. When a user attempts to open the attachment in Tiger, a warning is displayed that the file is an executable and not an image.
"Apple apparently either did not incorporate this update into Leopard, or did not do it correctly," said Heise Security.
The security firm has set up a webpage which sends the user an email to test for the vulnerability.
Insecticides based on sulfoxaflor might be as bad for bees as neonicotinoids
Intel teases forthcoming new graphics card accompanied by the text "We will set our graphics free"
Think your password manager is completely secure? Think again...
ARM plans 7nm 'Deimos' for 2019 and 5nm and 7nm 'Hercules' for 2020