CVE-2020-12387: 
NixOS vulnerability analysis and mitigation

A race condition vulnerability (CVE-2020-12387) was discovered in Mozilla Firefox and Thunderbird's Web Worker shutdown code. The vulnerability was reported by Looben Yang and affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. The issue was disclosed on May 5, 2020, and fixed in Firefox 76 and Firefox ESR 68.8 (Mozilla Advisory, NVD).

The vulnerability is caused by a race condition that occurs when running shutdown code for Web Worker, leading to a use-after-free memory flaw. This resulted in a potentially exploitable crash. The issue has a CVSS 3.1 Base Score of 8.1 (High), with attack vector: Network, attack complexity: High, privileges required: None, user interaction: None, scope: Unchanged, and impact levels of High for confidentiality, integrity, and availability (Ubuntu Security).

The vulnerability could allow an attacker to execute arbitrary code through memory corruption. The use-after-free condition could be exploited to cause a crash and potentially lead to arbitrary code execution with the privileges of the process (Gentoo Security).

The vulnerability was demonstrated to be exploitable, with proof-of-concept code showing EIP control on 32-bit Firefox. A security researcher provided evidence of successful exploitation leading to arbitrary code execution (Mozilla Bug).

The vulnerability was patched in Firefox 76, Firefox ESR 68.8, and Thunderbird 68.8.0. Users are advised to upgrade to these versions or later. For Firefox, the fix was released in version 76.0+build2, and for Thunderbird, in version 68.8.0+build2 (Ubuntu Advisory).