CVE-2024-5701: 
NixOS vulnerability analysis and mitigation

Memory safety bugs were discovered in Firefox 126, identified as CVE-2024-5701. The vulnerability was reported by Randell Jesup and the Mozilla Fuzzing Team, and was fixed with the release of Firefox 127 on June 11, 2024. These bugs showed evidence of memory corruption that could potentially be exploited to execute arbitrary code (Mozilla Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-787 (Out-of-bounds Write) (NVD, CIS Advisory).

If successfully exploited, these memory safety bugs could allow an attacker to execute arbitrary code in the context of the logged-on user. Depending on the user's privileges, an attacker could potentially install programs, view or modify data, or create new accounts with full user rights (CIS Advisory).

There are currently no reports of this vulnerability being actively exploited in the wild. However, the Mozilla security team has indicated that with sufficient effort, these memory corruption bugs could potentially be exploited to run arbitrary code (Mozilla Advisory).

The vulnerability has been fixed in Firefox 127. Users are strongly advised to update their Firefox installations to version 127 or later. For Ubuntu 20.04 LTS users, the fixed version is 127.0.2+build1-0ubuntu0.20.04.1 (Ubuntu Notice).