Linux · Amazon Linux · Security advisory · July 6, 2026

ALAS2023-2026-1928: Security update for 3 packages

ALAS2023-2026-1928, released July 6, 2026, fixes 42 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
42
6 rated Critical
Exploited
0
None reported
Highest CVSS
9.6
Base score, 0 to 10
Highest EPSS
0.0088
59th percentile

Priority of the 42 CVEs

Patch now 0 Urgent 6 High 26 Routine 10

Fixed package versions

ProductReleaseFixed in
firefoxamzn 2023140.12.0-1.amzn2023.0.1
firefox-debuginfoamzn 2023140.12.0-1.amzn2023.0.1
firefox-debugsourceamzn 2023140.12.0-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-12295 Sandbox escape in the DOM: Navigation component9.6 0.0039 None reported
Urgent CVE-2026-12296 Sandbox escape in the Security: Process Sandboxing component9.6 0.0039 None reported
Urgent CVE-2026-12297 Sandbox escape due to incorrect boundary conditions in the Networking component9.6 0.0039 None reported
Urgent CVE-2026-12294 Sandbox escape in the DOM: Workers component9.6 0.0036 None reported
Urgent CVE-2026-12315 Mitigation bypass in the DOM: Security component9.1 0.0025 None reported
Urgent CVE-2026-12304 Same-origin policy bypass in the Networking: Cookies component9.1 0.0019 None reported
High CVE-2026-56211 aom: A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation7.1 0.0088 None reported
High CVE-2026-56210 aom: A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation7.1 0.0058 None reported
High CVE-2026-12292 Incorrect boundary conditions in the Web Audio component8.1 0.0049 None reported
High CVE-2026-12328 Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 1528.1 0.0048 None reported
High CVE-2026-56208 firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Secu...8.8 0.0045 None reported
High CVE-2026-12327 Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 1528.1 0.0041 None reported
High CVE-2026-12290 Memory safety bug fixed in Thunderbird 1528.1 0.0040 None reported
High CVE-2026-12289 Privilege escalation in the Graphics: WebRender component8.8 0.0040 None reported
High CVE-2026-12291 Use-after-free in the Networking: HTTP component8.8 0.0038 None reported
High CVE-2026-12305 Memory safety bug fixed in Thunderbird 1527.5 0.0037 None reported
High CVE-2026-12329 Memory safety bug fixed in Thunderbird ESR 140.127.5 0.0031 None reported
High CVE-2026-12298 Memory safety bug fixed in Thunderbird 1527.5 0.0031 None reported
High CVE-2026-12299 JIT miscompilation in the DOM: Core & HTML component7.5 0.0031 None reported
High CVE-2026-12306 Memory safety bug fixed in Thunderbird 1527.5 0.0026 None reported
High CVE-2026-12307 Memory safety bug fixed in Thunderbird 1527.5 0.0026 None reported
High CVE-2026-12308 Memory safety bug fixed in Thunderbird 1527.5 0.0026 None reported
High CVE-2026-12310 Memory safety bug fixed in Thunderbird 1527.5 0.0025 None reported
High CVE-2026-12312 Memory safety bug fixed in Thunderbird 1527.5 0.0025 None reported
High CVE-2026-12314 Memory safety bug fixed in Thunderbird 1527.5 0.0025 None reported
Showing 1 to 25 of 42 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.