Linux · Amazon Linux · Security advisory · August 31, 2026

ALAS2023-2026-2105: Security update for 3 packages

ALAS2023-2026-2105, released August 31, 2026, fixes 38 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
38
6 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0096
61st percentile

Priority of the 38 CVEs

Patch now 0 Urgent 6 High 30 Routine 2

Fixed package versions

ProductReleaseFixed in
firefoxamzn 2023140.14.0-1.amzn2023.0.1
firefox-debuginfoamzn 2023140.14.0-1.amzn2023.0.1
firefox-debugsourceamzn 2023140.14.0-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-74943 Use-after-free in the Graphics: ImageLib component9.8 0.0096 None reported
Urgent CVE-2026-74964 Integer overflow in the Graphics component9.8 0.0060 None reported
Urgent CVE-2026-74940 Use-after-free in the Graphics: Text component9.8 0.0041 None reported
Urgent CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component9.8 0.0040 None reported
Urgent CVE-2026-74944 Use-after-free in the DOM: Core & HTML component9.8 0.0040 None reported
Urgent CVE-2026-74959 Mitigation bypass in the Storage: Cache API component9.1 0.0034 None reported
High CVE-2026-66046 Expat Denial of Service via storeAtts() Quadratic Complexity7.5 0.0074 None reported
High CVE-2026-74945 Information disclosure in the Graphics: Text component7.5 0.0071 None reported
High CVE-2026-74988 Internally found bugs fixed in Thunderbird ESR 153.1 and Thunderbird 1549.8 0.0061 None reported
High CVE-2026-74990 Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 1549.8 0.0053 None reported
High CVE-2026-74987 Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 1549.8 0.0052 None reported
High CVE-2026-74938 Mitigation bypass in the JavaScript: GC component9.1 0.0044 None reported
High CVE-2026-74950 Privilege escalation in the Downloads API component8.8 0.0042 None reported
High CVE-2026-74969 Use-after-free in the Layout: Text and Fonts component8.8 0.0040 None reported
High CVE-2026-74946 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component8.8 0.0033 None reported
High CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component8.1 0.0033 None reported
High CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component7.5 0.0032 None reported
High CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component8.8 0.0032 None reported
High CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component7.5 0.0032 None reported
High CVE-2026-74949 Privilege escalation due to use-after-free in the Graphics: Canvas2D component8.8 0.0032 None reported
High CVE-2026-74948 Information disclosure in the Graphics component7.5 0.0031 None reported
High CVE-2026-74935 Privilege escalation in the DOM: Networking component8.8 0.0031 None reported
High CVE-2026-74939 Privilege escalation in the DOM: Navigation component8.8 0.0030 None reported
High CVE-2026-74942 Privilege escalation in the Remote Settings Client component8.8 0.0030 None reported
High CVE-2026-74965 Privilege escalation in the Shell Integration component8.8 0.0030 None reported
Showing 1 to 25 of 38 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.