ALAS2023-2025-1337

References: CVE-2025-14321  CVE-2025-14322  CVE-2025-14323  CVE-2025-14324  CVE-2025-14325  CVE-2025-14328  CVE-2025-14329  CVE-2025-14330  CVE-2025-14331  CVE-2025-14333  CVE-2025-66293 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Use-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox < 146 and Firefox ESR < 140.6. (CVE-2025-14321)

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, and Firefox ESR < 140.6. (CVE-2025-14322)

Privilege escalation in the DOM: Notifications component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, and Firefox ESR < 140.6. (CVE-2025-14323)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, and Firefox ESR < 140.6. (CVE-2025-14324)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146 and Firefox ESR < 140.6. (CVE-2025-14325)

Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146 and Firefox ESR < 140.6. (CVE-2025-14328)

Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146 and Firefox ESR < 140.6. (CVE-2025-14329)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146 and Firefox ESR < 140.6. (CVE-2025-14330)

Same-origin policy bypass in the Request Handling component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, and Firefox ESR < 140.6. (CVE-2025-14331)

Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 146 and Firefox ESR < 140.6. (CVE-2025-14333)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later. (CVE-2025-66293)

Issue Correction:
Run dnf update firefox --releasever 2023.10.20260105 or dnf update --advisory ALAS2023-2025-1337 --releasever 2023.10.20260105 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    firefox-debuginfo-140.6.0-1.amzn2023.0.1.aarch64
    firefox-140.6.0-1.amzn2023.0.1.aarch64
    firefox-debugsource-140.6.0-1.amzn2023.0.1.aarch64

src:
    firefox-140.6.0-1.amzn2023.0.1.src

x86_64:
    firefox-debuginfo-140.6.0-1.amzn2023.0.1.x86_64
    firefox-140.6.0-1.amzn2023.0.1.x86_64
    firefox-debugsource-140.6.0-1.amzn2023.0.1.x86_64