CVE-2024-0746: 
NixOS vulnerability analysis and mitigation

CVE-2024-0746 is a moderate severity vulnerability affecting Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. The vulnerability was discovered by Cornel Ionce and disclosed on January 23, 2024. The issue occurs when a Linux user opens the print preview dialog, which could cause the browser to crash (Mozilla Advisory).

The vulnerability is caused by a use-after-free (UAF) bug in GTK code rather than in Firefox code. The issue occurs in the gtk_printer_get_name function when handling printer enumeration. The crash happens during a reentrant event loop where GTK printer data gets destroyed after finding a specific printer, leading to accessing freed memory. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The vulnerability results in a denial of service condition through browser crashes when Linux users attempt to use the print preview functionality. The impact is rated as moderate since it only affects the availability of the application and requires user interaction (Mozilla Advisory).

The vulnerability has been fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Users are advised to upgrade to these versions or later to mitigate the issue (Debian Advisory).