Linux · Amazon Linux · Security advisory · August 17, 2026

ALAS2023-2026-2069: Security update for 3 packages

ALAS2023-2026-2069, released August 17, 2026, fixes 31 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
31
22 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0087
58th percentile

Priority of the 31 CVEs

Patch now 0 Urgent 22 High 9 Routine 0

Fixed package versions

ProductReleaseFixed in
firefoxamzn 2023140.13.0-1.amzn2023.0.1
firefox-debuginfoamzn 2023140.13.0-1.amzn2023.0.1
firefox-debugsourceamzn 2023140.13.0-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-16357 Incorrect boundary conditions in the Graphics component9.8 0.0087 None reported
Urgent CVE-2026-16412 Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 1539.8 0.0064 None reported
Urgent CVE-2026-16353 Invalid pointer in the DOM: Bindings (WebIDL) component9.8 0.0052 None reported
Urgent CVE-2026-16360 Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 1539.8 0.0047 None reported
Urgent CVE-2026-16363 JIT miscompilation in the JavaScript: WebAssembly component9.8 0.0044 None reported
Urgent CVE-2026-16369 Integer overflow in the JavaScript: WebAssembly component9.8 0.0044 None reported
Urgent CVE-2026-16350 Incorrect boundary conditions in the Audio/Video: cubeb component9.8 0.0041 None reported
Urgent CVE-2026-16355 JIT miscompilation in the JavaScript Engine: JIT component9.8 0.0041 None reported
Urgent CVE-2026-16351 Sandbox escape due to use-after-free in the DOM: Navigation component9.8 0.0039 None reported
Urgent CVE-2026-16352 Sandbox escape due to use-after-free in the Disability Access APIs component9.8 0.0039 None reported
Urgent CVE-2026-16356 Sandbox escape due to use-after-free in the Disability Access APIs component9.8 0.0039 None reported
Urgent CVE-2026-16368 Incorrect boundary conditions in the JavaScript: WebAssembly component9.8 0.0039 None reported
Urgent CVE-2026-16377 Mitigation bypass in the PDF Viewer component9.8 0.0039 None reported
Urgent CVE-2026-16383 Mitigation bypass in the DOM: Networking component9.8 0.0039 None reported
Urgent CVE-2026-16390 Mitigation bypass in the Enterprise Policies component9.1 0.0032 None reported
Urgent CVE-2026-16361 Memory safety bugs fixed in Thunderbird ESR 140.139.8 0.0032 None reported
Urgent CVE-2026-16359 Incorrect boundary conditions in the Audio/Video: GMP component9.1 0.0026 None reported
Urgent CVE-2026-16358 Site isolation issue in the Graphics: WebRender component9.8 0.0022 None reported
Urgent CVE-2026-16349 Same-origin policy bypass in the DOM: Navigation component9.8 0.0022 None reported
Urgent CVE-2026-16375 Site isolation issue in the Networking: HTTP component9.8 0.0021 None reported
Urgent CVE-2026-16387 Site isolation issue in the Networking component9.8 0.0020 None reported
Urgent CVE-2026-16381 Same-origin policy bypass in the Networking: DNS component9.1 0.0017 None reported
High CVE-2026-17501 firefox: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-17501: A flaw h...n/a 0.0072 None reported
High CVE-2026-16354 Information disclosure in the Graphics: ImageLib component8.8 0.0034 None reported
High CVE-2026-16374 Information disclosure in the Framework component in DevTools8.8 0.0032 None reported
Showing 1 to 25 of 31 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.