Linux · Amazon Linux · Security advisory · November 7, 2026

ALAS2023-2026-3214: Security update for 3 packages

ALAS2023-2026-3214, released November 7, 2026, fixes 127 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
127
23 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0046
39th percentile

Priority of the 127 CVEs

Patch now 0 Urgent 23 High 93 Routine 11

Fixed package versions

ProductReleaseFixed in
firefoxamzn 2023140.17.0-1.amzn2023.0.1
firefox-debuginfoamzn 2023140.17.0-1.amzn2023.0.1
firefox-debugsourceamzn 2023140.17.0-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-100788 Invalid pointer in the JavaScript: WebAssembly component9.8 0.0042 None reported
Urgent CVE-2026-100775 Sandbox escape in the Graphics component9.6 0.0033 None reported
Urgent CVE-2026-100781 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component9.6 0.0033 None reported
Urgent CVE-2026-92018 Sandbox escape in the DOM: Core & HTML component9.6 0.0033 None reported
Urgent CVE-2026-100794 Sandbox escape due to incorrect boundary conditions in the Internationalization component9.6 0.0032 None reported
Urgent CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component9.6 0.0032 None reported
Urgent CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component9.6 0.0032 None reported
Urgent CVE-2026-100770 Sandbox escape due to use-after-free in the DOM: Content Processes component9.6 0.0032 None reported
Urgent CVE-2026-100778 Sandbox escape due to use-after-free in the DOM: Core & HTML component9.6 0.0032 None reported
Urgent CVE-2026-100786 Sandbox escape due to use-after-free in the Graphics component9.6 0.0032 None reported
Urgent CVE-2026-92038 Mitigation bypass in the Remote Settings Client component9.1 0.0032 None reported
Urgent CVE-2026-92041 Mitigation bypass in the DOM: Networking component9.1 0.0032 None reported
Urgent CVE-2026-92075 Mitigation bypass in the Networking component9.1 0.0032 None reported
Urgent CVE-2026-100758 Sandbox escape in the DOM: Navigation component9.6 0.0030 None reported
Urgent CVE-2026-100760 Sandbox escape in the Security: Process Sandboxing component9.6 0.0030 None reported
Urgent CVE-2026-92045 Sandbox escape due to incorrect boundary conditions in the WebRTC component9.6 0.0030 None reported
Urgent CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component9.6 0.0027 None reported
Urgent CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component9.6 0.0027 None reported
Urgent CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component9.6 0.0026 None reported
Urgent CVE-2026-92057 Mitigation bypass in the Enterprise Policies component9.1 0.0025 None reported
Urgent CVE-2026-100828 Mitigation bypass in the Bookmarks & History component9.6 0.0024 None reported
Urgent CVE-2026-100829 Mitigation bypass in the DOM: Security component9.6 0.0024 None reported
Urgent CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component9.3 0.0011 None reported
High CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service7.5 0.0046 None reported
High CVE-2026-93990 Expat through 2.8.4 Malformed UTF-16 Acceptance via Unchecked Surrogate7.5 0.0040 None reported
Showing 1 to 25 of 127 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.