Heap-based buffer overflow in Research in Motion (RIM) BlackBerry Attachment Service allows remote attackers to cause a denial of service (hang) via an e-mail attachment with a crafted TIFF file.
http://www.vupen.com/english/advisories/2006/0011
http://www.securityfocus.com/bid/16098
http://www.kb.cert.org/vuls/id/570768