CVE-2022-45421: 
NixOS vulnerability analysis and mitigation

CVE-2022-45421 is a high-severity memory safety vulnerability discovered in Mozilla products. Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Firefox 106, Firefox ESR 102.4, and Thunderbird 102.4. The vulnerability was disclosed on November 15, 2022, affecting Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107 (Mozilla Advisory).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) with a CVSS v3.1 Base Score of 8.8 (HIGH). The attack vector is Network-based, requiring low attack complexity and no privileges, though user interaction is required. The scope is unchanged, with high impact potential across confidentiality, integrity, and availability vectors (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

The memory safety bugs showed evidence of memory corruption, and with sufficient effort, these vulnerabilities could potentially be exploited to execute arbitrary code on affected systems (Mozilla Advisory).

The vulnerability requires user interaction to exploit, though it has low attack complexity. The bugs showed evidence of memory corruption, suggesting potential exploitability for arbitrary code execution (Mozilla Advisory).

The vulnerability has been fixed in Firefox 107, Firefox ESR 102.5, and Thunderbird 102.5. Users should update their software to these versions or newer to mitigate the risk (Mozilla Advisory).