Integer overflows and buffer overflows in graphics API and fonts API.
vulners.com/securityvulns/securityvulns:doc:20289
vulners.com/securityvulns/securityvulns:doc:20290