From secunia security advisory at $URL:
The vulnerability is caused due to a boundary error within the "receive_packet()" function (libusbmuxd/libusbmuxd.c) when processing a property list containing an overly long "SerialNumber" field, which can be exploited to cause a heap-based buffer overflow.
Successful exploitation may allow the execution of arbitrary code, but requires that the attacker is able to connect a malicious USB device.
Fixed in the GIT repository.
Fixed by 1.0.7-r1, CCing amd64 and x86
x86 stable. No hardware to test, though
Filed new request.
This issue was resolved and addressed in
GLSA 201203-11 at http://security.gentoo.org/glsa/glsa-201203-11.xml
by GLSA coordinator Sean Amoss (ackle).