CVE-2020-15651: 
NixOS vulnerability analysis and mitigation

CVE-2020-15651 is a security vulnerability discovered in Firefox for iOS that affects the download feature. The vulnerability was disclosed on July 28, 2020, and fixed in Firefox for iOS version 28. The issue affects the way the browser handles unicode Right-to-Left Override (RTLO) characters in downloaded file names (Mozilla Advisory).

The vulnerability allows a unicode RTL order character in the downloaded file name to be used to manipulate the file's extension during the download UI flow. This can result in the file appearing to have a different extension than its actual type. The vulnerability was assessed with a low severity impact rating (Mozilla Advisory, Bugzilla).

When exploited, this vulnerability could cause users to misidentify file types during download, as the file would appear to have one extension while actually being a different type. However, due to iOS's built-in file handling restrictions, the practical impact of this vulnerability is limited compared to similar issues on other platforms (Bugzilla).

The vulnerability can be exploited by using special unicode RTLO characters in filenames to make files appear to have different extensions than their actual types. For example, an executable file could be made to appear as an image file. However, due to iOS security restrictions, the practical exploitation potential is limited (Bugzilla).

The vulnerability was fixed in Firefox for iOS version 28. Users should update to this version or later to receive the security fix (Mozilla Advisory).