CVE-2024-7520: 
NixOS vulnerability analysis and mitigation

A type confusion vulnerability (CVE-2024-7520) was discovered in WebAssembly that affects Mozilla Firefox versions before 129, Firefox ESR versions before 128.1, and Thunderbird versions before 128.1. The vulnerability was reported by security researcher Nan Wang and was disclosed on August 6, 2024 (Mozilla Advisory, NVD).

The vulnerability is classified as a type confusion bug (CWE-843) in WebAssembly implementation. It received a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

If successfully exploited, this vulnerability could potentially allow an attacker to achieve code execution on the affected system. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the affected system (Mozilla Advisory).

The vulnerability requires user interaction to be exploited and can be accessed through network vectors. While detailed exploit information is not publicly available, the vulnerability has been assigned a low attack complexity rating, suggesting it could be relatively straightforward to exploit once the conditions are met (NVD).

Mozilla has addressed this vulnerability in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Users are advised to update their software to these versions or newer to mitigate the risk (Mozilla Advisory, Mozilla ESR Advisory).