CVE-2022-46885: 
NixOS vulnerability analysis and mitigation

Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team discovered memory safety bugs in Firefox 105 that were addressed in Firefox 106. The vulnerability, tracked as CVE-2022-46885, was publicly disclosed on December 22, 2022, and affected all versions of Firefox prior to version 106.0 (Mozilla Advisory, NVD).

The vulnerability is characterized by memory safety bugs that showed evidence of memory corruption. The issue has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-787 (Out-of-bounds Write) (NVD).

The memory safety bugs showed evidence of memory corruption, and security researchers presumed that with sufficient effort, these vulnerabilities could have been exploited to execute arbitrary code on affected systems (Mozilla Advisory).

The vulnerability was patched in Firefox version 106.0. Users are advised to upgrade to this version or later to mitigate the risk. The fix was included in the original release of Firefox 106, though it was not initially documented in the advisory until December 13, 2022 (Mozilla Advisory).