Apple has issued a upgrade to the set-top box adding supports for remote control of iTunes & MobileMe and some security flaws
All six of the issues addressed with this last batch of patches deal with the potential for arbitrary code execution, with all but one also possibly leading to crashes of the device.
Three of the flaws can be exploited through movie files, two through QuickTime, and the last through PICT images.