CVE-2024-4769: 
NixOS vulnerability analysis and mitigation

CVE-2024-4769 is a security vulnerability discovered in Mozilla Firefox and Thunderbird that affects their Web Workers functionality. The vulnerability was disclosed on May 14, 2024, and affects Firefox versions below 126, Firefox ESR versions below 115.11, and Thunderbird versions below 115.11. The issue involves error messages that could distinguish between application/javascript responses and non-script responses when importing resources using Web Workers (Mozilla Advisory, NVD).

The vulnerability stems from a flaw in the error message handling system of Web Workers when importing resources. When attempting to import resources, the error messages would differentiate between application/javascript responses and non-script responses, creating a potential information leak vector. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-accessible vulnerability requiring no privileges or user interaction (NVD).

The vulnerability could be exploited to learn information cross-origin, potentially allowing attackers to gather sensitive information about web resources. This cross-origin information leak could be abused to determine the content type of resources on other domains, which should normally be protected by same-origin policy restrictions (Mozilla Advisory).

The vulnerability has been classified with high complexity (AC:H) in its CVSS score, indicating that specific conditions need to be met for successful exploitation. It requires no privileges or user interaction but does need network access to the target system. The vulnerability was discovered and reported by security researcher Shaheen Fazim (Mozilla Advisory).

The vulnerability has been fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Users are advised to upgrade to these versions or later to mitigate the risk. The fix involves normalizing error messages to prevent the distinction between different types of responses (Mozilla Advisory, Debian Advisory).