ALAS2027-2026-177

References: CVE-2026-50219  CVE-2026-56131  CVE-2026-56132  CVE-2026-56404  CVE-2026-56405  CVE-2026-56408  CVE-2026-56412  CVE-2026-66046  CVE-2026-76957  CVE-2026-84118  CVE-2026-84119  CVE-2026-84120  CVE-2026-84121  CVE-2026-84122  CVE-2026-84123  CVE-2026-84124  CVE-2026-84125  CVE-2026-84129  CVE-2026-84130  CVE-2026-84131  CVE-2026-84132  CVE-2026-84133  CVE-2026-84134  CVE-2026-84136  CVE-2026-84137  CVE-2026-84139  CVE-2026-84140  CVE-2026-84141  CVE-2026-84143  CVE-2026-84144  CVE-2026-84145  CVE-2026-85049  CVE-2026-92005  CVE-2026-92006  CVE-2026-92007  CVE-2026-92008  CVE-2026-92009  CVE-2026-92010  CVE-2026-92011  CVE-2026-92012  CVE-2026-92013  CVE-2026-92015  CVE-2026-92016  CVE-2026-92017  CVE-2026-92018  CVE-2026-92019  CVE-2026-92020  CVE-2026-92022  CVE-2026-92023  CVE-2026-92024  CVE-2026-92025  CVE-2026-92026  CVE-2026-92027  CVE-2026-92028  CVE-2026-92029  CVE-2026-92030  CVE-2026-92031  CVE-2026-92032  CVE-2026-92035  CVE-2026-92038  CVE-2026-92039  CVE-2026-92041  CVE-2026-92042  CVE-2026-92043  CVE-2026-92044  CVE-2026-92045  CVE-2026-92046  CVE-2026-92047  CVE-2026-92052  CVE-2026-92053  CVE-2026-92054  CVE-2026-92055  CVE-2026-92056  CVE-2026-92057  CVE-2026-92058  CVE-2026-92059  CVE-2026-92060  CVE-2026-92062  CVE-2026-92067  CVE-2026-92068  CVE-2026-92069  CVE-2026-92070  CVE-2026-92072  CVE-2026-92073  CVE-2026-92074  CVE-2026-92075  CVE-2026-92076  CVE-2026-92077  CVE-2026-92078 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-92078:
Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92077:
Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92076:
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92075:
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92074:
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92073:
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92072:
Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92070:
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92069:
Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92068:
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92067:
Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92062:
Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92060:
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92059:
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92058:
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92057:
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92056:
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92055:
Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92054:
Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92053:
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92052:
Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92047:
Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92046:
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92045:
Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92044:
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92043:
Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92042:
Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92041:
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92039:
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92038:
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92035:
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

CVE-2026-92032:
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92031:
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92030:
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92029:
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92028:
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92027:
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92026:
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92025:
Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92024:
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92023:
Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92022:
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92020:
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92019:
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92018:
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92017:
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92016:
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92015:
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92013:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92012:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92011:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92010:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92009:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92008:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92007:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92006:
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-92005:
Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3.

CVE-2026-85049:
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-84145:
Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84144:
Internally found bugs present in Firefox 154 and Firefox ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84143:
Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84141:
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84140:
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84139:
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84137:
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84136:
Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84134:
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84133:
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84132:
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84131:
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84130:
Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84129:
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84125:
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84124:
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84123:
Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-84122:
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84121:
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84120:
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84119:
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

CVE-2026-84118:
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

CVE-2026-76957:
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

CVE-2026-66046:
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

CVE-2026-56412:
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

CVE-2026-56408:
libexpat before 2.8.2 has an integer overflow in copyString.

CVE-2026-56405:
libexpat before 2.8.2 has an integer overflow in getAttributeId.

CVE-2026-56404:
libexpat before 2.8.2 has an integer overflow in addBinding.

CVE-2026-56132:
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.

CVE-2026-56131:
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).

CVE-2026-50219:
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

Issue Correction:
Run dnf update firefox or dnf update --advisory ALAS2027-2026-177 to update your system.

New Packages:

aarch64:
    firefox-debuginfo-153.3.0-1.amzn2027.0.2.aarch64
    firefox-153.3.0-1.amzn2027.0.2.aarch64
    firefox-debugsource-153.3.0-1.amzn2027.0.2.aarch64

src:
    firefox-153.3.0-1.amzn2027.0.2.src

x86_64:
    firefox-debuginfo-153.3.0-1.amzn2027.0.2.x86_64
    firefox-153.3.0-1.amzn2027.0.2.x86_64
    firefox-debugsource-153.3.0-1.amzn2027.0.2.x86_64