CVE-2022-22739: 
NixOS vulnerability analysis and mitigation

CVE-2022-22739 is a security vulnerability discovered in Mozilla Firefox and Thunderbird that affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. The vulnerability was disclosed on January 11, 2022, where malicious websites could potentially trick users into accepting and launching a program to handle an external URL protocol (Mozilla Advisory, NVD).

The vulnerability was rated with a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The technical issue stemmed from missing throttling on the external protocol launch dialog, which could allow malicious websites to manipulate how external URL protocols were handled (NVD).

The vulnerability could allow malicious websites to trick users into launching unauthorized programs through external URL protocol handlers. When exploited, the vulnerability could lead to potential security risks by convincing users to execute unintended programs on their systems (Mozilla Advisory).

The vulnerability was addressed in Firefox 96, Firefox ESR 91.5, and Thunderbird 91.5. Users were advised to update their software to these versions or newer to mitigate the security risk. The fix was implemented through a patch that addressed the missing throttling mechanism in the external protocol launch dialog (Mozilla Advisory).