Amazon Linux 2 Security Advisory: ALAS2-2026-3315
Advisory Released Date: 2026-05-26
Advisory Updated Date: 2026-05-26
FAQs regarding Amazon Linux ALAS/CVE Severity
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. (CVE-2026-45186)
Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, and Firefox ESR 115.35.2. (CVE-2026-8090)
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2. (CVE-2026-8091)
Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, and Firefox ESR 115.35.2. (CVE-2026-8092)
Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2. (CVE-2026-8094)
Affected Packages:
thunderbird
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update thunderbird or yum update --advisory ALAS2-2026-3315 to update your system.
aarch64:
thunderbird-140.10.2-1.amzn2.0.2.aarch64
src:
thunderbird-140.10.2-1.amzn2.0.2.src
x86_64:
thunderbird-140.10.2-1.amzn2.0.2.x86_64