Filename Handling Flaw in Mozilla Products Exposes Users to Security Risks

CVE-2023-29539

Summary

A vulnerability exists in various Mozilla products related to the handling of the filename directive within the Content-Disposition header. If a filename contains a NULL character, it is truncated, which may lead to reflected file download attacks. This could potentially deceive users into unknowingly installing malicious software. Users of affected versions of Firefox, Thunderbird, and Focus for Android should be aware of this security concern and take necessary precautions.

References