CVE-2023-4049: 
NixOS vulnerability analysis and mitigation

Race conditions in reference counting code were discovered in Firefox browser versions < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. The vulnerability was identified through code inspection and was assigned CVE-2023-4049. The issue was reported by Nika Layzell and was disclosed on August 1, 2023 (Mozilla Advisory).

The vulnerability stems from race conditions in reference counting code implementations that could potentially lead to use-after-free vulnerabilities. The issue has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network accessible but requires high attack complexity (NVD).

The race conditions in reference counting code could result in potentially exploitable use-after-free vulnerabilities. These vulnerabilities could lead to memory corruption and potentially allow arbitrary code execution with enough effort (Mozilla Advisory).

The vulnerability has been fixed in Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1. Users are recommended to upgrade to these or later versions. The fix involves using refcounting macros instead of manual reference counting implementations (Mozilla Advisory).