CVE-2022-36318: 
NixOS vulnerability analysis and mitigation

CVE-2022-36318 is a security vulnerability discovered in Mozilla Firefox and Thunderbird that affects directory listings for chrome:// URLs. The vulnerability was discovered by Gijs Kruitbosch and disclosed in July 2022. It affects multiple versions of Mozilla products including Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12 (Mozilla Advisory, CVE Mitre).

The vulnerability occurs when visiting directory listings for chrome:// URLs as source text, where certain URL parameters were being reflected in the output. The issue was rated as having moderate impact and was tracked in Mozilla's bug tracking system under Bug 1771774 (Mozilla Bug).

The vulnerability could potentially lead to security implications when visiting directory listings for chrome:// URLs, as URL parameters were being reflected in the output. The issue was assessed as having a moderate impact level (Mozilla Advisory).

While specific exploit details are not publicly disclosed, the vulnerability was confirmed to be reproducible by visiting chrome:// URLs and checking the source text output. The issue was verified across multiple platforms including Windows 10, Ubuntu 22, and Mac OS 11 (Mozilla Bug).

The vulnerability was patched in Firefox 103, Firefox ESR 102.1, Firefox ESR 91.12, Thunderbird 102.1, and Thunderbird 91.12. Users are advised to update to these or later versions to mitigate the vulnerability (Mozilla Advisory).