CVE-2024-6608: 
NixOS vulnerability analysis and mitigation

A security vulnerability identified as CVE-2024-6608 was discovered in Firefox and Thunderbird versions prior to 128. The vulnerability, reported by Irvan Kurniawan, allowed an attacker to move the cursor using pointerlock from an iframe, enabling cursor movement outside of both the viewport and the Firefox/Thunderbird window (Mozilla Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The vulnerability requires user interaction and can be exploited through network access, with no privileges required. The impact primarily affects availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability affects the availability of the system by allowing unauthorized cursor movement outside the intended boundaries of the application window. This could potentially impact user experience and application control (Mozilla Advisory).

The vulnerability has been fixed in Firefox and Thunderbird version 128. Users are advised to update their software to these versions or later to mitigate the risk. For Ubuntu 20.04 LTS users, the fix is available in firefox version 128.0+build2-0ubuntu0.20.04.1 (Ubuntu Notice).