Integer overflow in HFS in Apple Mac OS X before 10.6.7 allows local users to read arbitrary (1) HFS, (2) HFS+, or (3) HFS+J files via a crafted F_READBOOTSTRAP ioctl call.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2011-0206
http://support.apple.com/kb/HT4581
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html