The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11 10.5.4 and 10.5.5 uses an uninitialized variable which allows remote attackers to execute arbitrary code via a crafted applet related to an \error checking issue.\