CVE-2020-12395: 
NixOS vulnerability analysis and mitigation

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. The vulnerability (CVE-2020-12395) was discovered in May 2020 and affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. These memory safety bugs showed evidence of memory corruption that could potentially be exploited to run arbitrary code (Mozilla Advisory).

The vulnerability is classified as a critical severity issue with a CVSS v3.1 base score of 9.8 (CRITICAL) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is categorized as an Out-of-bounds Write (CWE-787) vulnerability. The bugs were discovered by multiple Mozilla developers and community members including Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas Schouten, André Bargull, and Karl Tomlinson (NVD).

The vulnerability could allow an attacker to execute arbitrary code with enough effort due to memory corruption issues. This could potentially lead to complete system compromise with the privileges of the affected application (Mozilla Advisory, Gentoo Advisory).

The memory safety bugs showed evidence of memory corruption, and Mozilla security researchers presumed that with sufficient effort, these vulnerabilities could be exploited to execute arbitrary code. The vulnerability requires network access but no authentication or user interaction (NVD).

The vulnerability was fixed in Firefox 76.0, Firefox ESR 68.8.0, and Thunderbird 68.8.0. Users are advised to upgrade to these versions or later to mitigate the vulnerability. For Thunderbird specifically, while these flaws cannot generally be exploited through email since scripting is disabled when reading mail, they remain potential risks in browser or browser-like contexts (Mozilla Advisory).