Web servers. Links to the code may be sent via email, but the malicious code is coming from web servers.
In the mid-90’s while working for the guys who yearly earned the FED t-shirt in Vegas, I heard a curious tale about why MAC’s were vulnerable to viruses. As the story goes, the earliest phreakers turned hackers hatted Bill Gates for screwing Steve Jobs out of millions after stealing the GUI environment idea from Apple. They turned their passionate hate for Bill’s alleged greed against all things Microsoft and passed the same hate to future hackers down the line. Couple that with the low market share of Apple, Microsoft products have had to live with all sorts of malfeasance (ideological, for sport, and otherwise). Some might say Microsoft is better positioned to deal with malware than Apple is due to their long battle waged through the years. I have heard that since Steve’s passing, the loyalty to the old anti-Microsoft hacker jihad may wane finally opening the way for hackers to go after Apple products as they have done with Microsoft (i.e. Apple may no longer be the beneficiary of many black hat hacker’s benevolence). If this is true and CVE Details is correct, I would be very careful in running any Apple product without a virus protection among other tools.