CVE-2022-46882: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2022-46882) was discovered in WebGL extensions that could lead to a potentially exploitable crash. The vulnerability was identified in December 2022 and affects Firefox versions prior to 107, Firefox ESR versions before 102.6, and Thunderbird versions before 102.6 (Mozilla Advisory, NVD).

The vulnerability is classified as a use-after-free (CWE-416) issue in WebGL extensions implementation. It received a CVSS v3.1 base score of 9.8 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity and potential for remote exploitation (NVD). The technical analysis revealed that the vulnerability occurs due to improper handling of memory references in WebGL extension operations (Mozilla Advisory).

The vulnerability could result in a potentially exploitable crash of the affected applications. While rated as having moderate impact by Mozilla, the CVSS score indicates potential for high impact on confidentiality, integrity, and availability if successfully exploited (Mozilla Advisory, NVD).

The vulnerability was addressed in Firefox 107, Firefox ESR 102.6, and Thunderbird 102.6. Users are advised to upgrade to these or later versions to mitigate the risk. The fix was implemented by improving the handling of memory references in WebGL extensions (Mozilla Advisory, Gentoo Advisory).