CVE-2022-45407: 
NixOS vulnerability analysis and mitigation

CVE-2022-45407 is a high-severity vulnerability discovered in Firefox versions prior to 107. The vulnerability was disclosed on November 15, 2022, and affects Firefox's font loading functionality. The issue occurs when fonts are loaded using FontFace() on a background worker, which was found to be not thread-safe (Mozilla Advisory).

The vulnerability is a use-after-free condition that occurs when loading fonts using FontFace() on a background worker thread. The thread-unsafe implementation could lead to a heap-use-after-free scenario, potentially resulting in a exploitable crash. The vulnerability has been assigned a CVSS 3.1 base score of 7.5 (High) (Ubuntu CVE).

If successfully exploited, this vulnerability could lead to a potentially exploitable crash of the browser. The use-after-free condition could potentially allow an attacker to execute arbitrary code within the context of the browser (Mozilla Advisory).

The vulnerability was patched in Firefox version 107. Users are advised to upgrade to Firefox 107 or later to mitigate this security issue. The fix was also included in subsequent security updates for various Linux distributions including Ubuntu (Ubuntu Notice).