Mozilla Foundation Security Advisory 2009-62
Title: Download filename spoofing with RTL override
Announced: October 27, 2009
Reporter: Jesse Ruderman, Sid Stamm
Products: Firefox, SeaMonkey
Fixed in: Firefox 3.5.4
Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this vulnerability to obfuscate the name and file extension of a file to be downloaded and opened, potentially causing a user to run an executable file when they expected to open a non-executable file.