CVE-2021-23961: 
NixOS vulnerability analysis and mitigation

CVE-2021-23961 is a security vulnerability discovered in Mozilla Firefox browser versions prior to 85. The vulnerability was disclosed on January 26, 2021, and involves techniques that built upon the slipstream research. When combined with a malicious webpage, this vulnerability could expose both internal network hosts and services running on the user's local machine (Mozilla Advisory).

The vulnerability is classified with a CVSS 3 Severity Score of 7.4 (High). The attack vector is Network-based, with low attack complexity, requiring no privileges but does need user interaction. The scope is changed, with high confidentiality impact but no integrity or availability impact. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N (Ubuntu Security).

The vulnerability could allow attackers to expose both internal network hosts and services running on the user's local machine through a malicious webpage. This presents a significant information disclosure risk, potentially revealing sensitive network topology and service information to malicious actors (Mozilla Advisory).

The vulnerability requires user interaction with a malicious webpage to be exploited. The attack complexity is considered low, making it relatively straightforward to exploit once the user interaction requirement is met. The vulnerability affects Firefox versions below 85 and was addressed in subsequent releases (CVE Mitre).

The vulnerability has been fixed in Firefox version 85 and Firefox ESR version 78.10.0. Users are advised to upgrade their Firefox installations to these versions or later. The fix has been widely distributed through various distribution channels, including Debian, Ubuntu, and Gentoo security updates (Debian Security, Ubuntu Security).