Safari in Mac OS X 10.3.9 and 10.4.2 when rendering Rich Text Format (RTF) files can directly access URLs without performing the normal security checks which allows remote attackers to execute arbitrary commands.