ALAS2023-2026-3126

References: CVE-2026-84119  CVE-2026-84120  CVE-2026-84121  CVE-2026-84122  CVE-2026-84124  CVE-2026-84131  CVE-2026-84143  CVE-2026-84145  CVE-2026-85049 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84143)

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. (CVE-2026-84145)

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) (CVE-2026-85049)

Issue Correction:
Run dnf update firefox --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3126 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    firefox-debuginfo-140.16.0-1.amzn2023.0.1.aarch64
    firefox-140.16.0-1.amzn2023.0.1.aarch64
    firefox-debugsource-140.16.0-1.amzn2023.0.1.aarch64

src:
    firefox-140.16.0-1.amzn2023.0.1.src

x86_64:
    firefox-debuginfo-140.16.0-1.amzn2023.0.1.x86_64
    firefox-140.16.0-1.amzn2023.0.1.x86_64
    firefox-debugsource-140.16.0-1.amzn2023.0.1.x86_64