Today, Month of Kernal Bugs has published information relating to how .dmg (ie disc image) files are handled:
Mac OS X fails to properly handle corrupted UDTO HFS+ image structures (ex. bad sectors), leading to an exploitable denial of service condition. Although it hasn’t been checked further, memory corruption is present under certain conditions (in this particular case, unlikely to allow arbitrary code execution). More …
Safari automatically opens dmg files, by default. This can be prevented by changing the Preferences and deactivating the functionality for ‘opening “safe” files after downloading’.