CVE-2024-6615: 
NixOS vulnerability analysis and mitigation

Memory safety bugs were identified in Firefox 127 and Thunderbird 127, tracked as CVE-2024-6615. The vulnerability was discovered by the Mozilla Fuzzing Team and disclosed on July 9, 2024. These bugs showed evidence of memory corruption that could potentially be exploited to execute arbitrary code. The vulnerability affects Firefox versions prior to 128 and Thunderbird versions prior to 128 (Mozilla Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is classified as CWE-787 (Out-of-bounds Write) according to CISA's assessment (CIS Advisory).

The vulnerability could allow an attacker to execute arbitrary code in the context of the logged-on user. If exploited successfully, an attacker could potentially install programs, view, change, or delete data, or create new accounts with full user rights, depending on the user's privileges (CIS Advisory).

The vulnerability has been fixed in Firefox 128 and Thunderbird 128. Users are advised to update their installations to these versions immediately. For Firefox ESR users, the update is available in version 115.13 (Mozilla Advisory).