Buffer overflow in Netscape Communicator prior to 4.7 via a dynamic font whose length field is less than the size of the font.
netscape communicator 4.5