CVE-2022-34482: 
NixOS vulnerability analysis and mitigation

CVE-2022-34482 is a security vulnerability discovered in Mozilla Firefox versions prior to 102. The vulnerability was reported by Attila Suszter and disclosed on June 28, 2022. It affects the drag-and-drop functionality in Firefox, where an attacker could manipulate the filename of a dragged image to contain an executable extension (Mozilla Advisory, NVD).

The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue occurs when a user drags and drops an image to a filesystem, where an attacker could manipulate the resulting filename to contain an executable extension. This vulnerability is distinct from but similar to CVE-2022-34483 (NVD).

If successfully exploited, this vulnerability could allow an attacker to trick users into executing malicious code through manipulated filenames. The impact is rated as moderate, as it requires user interaction in the form of dragging and dropping an image file (Mozilla Advisory).

The vulnerability was fixed in Firefox version 102. Users are advised to update their Firefox installations to version 102 or later to protect against this vulnerability (Mozilla Advisory).