Package Instance

Security research firm iDefense reported that
researcher regenrecht discovered a heap-based buffer
overflow in Mozilla's GIF image parser.  This vulnerability could
potentially be used by an attacker to crash a victim's browser and run
arbitrary code on their computer.

Security researcher Marco C. reported a flaw in
the parsing of regular expressions used in Proxy Auto-configuration
(PAC) files.  In certain cases this flaw could be used by an attacker
to crash a victim's browser and run arbitrary code on their computer.
Since this vulnerability requires the victim to have PAC configured in
their environment with specific regular expressions which can trigger
the crash, the severity of the issue was determined to be
moderate.

Mozilla security researchers Jesse Ruderman
and Sid Stamm reported that when downloading a file
containing a right-to-left override character (RTL) in the filename,
the name displayed in the dialog title bar conflicts with the name of
the file shown in the dialog body.  An attacker could use this
vulnerability to obfuscate the name and file extension of a file to be
downloaded and opened, potentially causing a user to run an executable
file when they expected to open a non-executable file.