CVE-2024-7522: 
NixOS vulnerability analysis and mitigation

CVE-2024-7522 is a security vulnerability discovered in Mozilla products where the editor code failed to check an attribute value properly. The vulnerability was disclosed on August 6, 2024, affecting multiple Mozilla products including Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14 (NVD).

The vulnerability is classified as an out-of-bounds read vulnerability (CWE-125). It has received a CVSS v3.1 base score of 8.8 (HIGH) from NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, CISA-ADP assessed it with a CVSS score of 9.1 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability could lead to an out-of-bounds read, potentially allowing attackers to access memory outside of intended boundaries. In the context of Thunderbird, Mozilla notes that these flaws cannot be exploited through email since scripting is disabled when reading mail, but they remain potential risks in browser or browser-like contexts (Mozilla Advisory).

The vulnerability requires network access and user interaction for exploitation. The attack complexity is considered low, requiring no privileges for execution. While the vulnerability has been publicly disclosed, there are no publicly known exploits specifically targeting this vulnerability at the time of the advisory (NVD).

Mozilla has released security updates to address this vulnerability. Users are advised to upgrade to Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, or Thunderbird 115.14, depending on their product version (Mozilla Advisory).