Amazon Linux 2 Security Advisory: ALAS2-2026-3295
Advisory Released Date: 2026-05-14
Advisory Updated Date: 2026-05-14
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox ESR 140.10.1. (CVE-2026-7321)
Memory safety bugs present in Firefox ESR 115.35.0, Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1. (CVE-2026-7322)
Memory safety bugs present in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Firefox ESR 140.10.1. (CVE-2026-7323)
Affected Packages:
thunderbird
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update thunderbird or yum update --advisory ALAS2-2026-3295 to update your system.
aarch64:
thunderbird-140.10.1-1.amzn2.0.1.aarch64
src:
thunderbird-140.10.1-1.amzn2.0.1.src
x86_64:
thunderbird-140.10.1-1.amzn2.0.1.x86_64