ALAS2027-2026-258

Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-258
Advisory Released Date: 2026-11-02
Advisory Updated Date: 2026-11-02
Severity: Important
Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-109783:
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5.

CVE-2026-109782:
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5.

CVE-2026-109781:
Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109778:
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109777:
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109776:
Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109775:
Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109770:
Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109767:
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109766:
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109765:
Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109764:
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109763:
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109762:
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109760:
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109759:
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109757:
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109756:
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109754:
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109753:
Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109752:
Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109751:
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109745:
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109744:
Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109743:
Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109742:
Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109741:
Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109738:
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109737:
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109736:
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109734:
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109733:
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109732:
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109731:
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109730:
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109729:
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109728:
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109727:
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109726:
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109725:
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109724:
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109723:
Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109722:
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109721:
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109720:
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109719:
Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109718:
Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109717:
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109716:
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109715:
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109713:
Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109712:
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109711:
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109710:
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109709:
Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109708:
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109707:
Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109706:
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.

CVE-2026-109705:
Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-109704:
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.

CVE-2026-100787:
Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

CVE-2026-100766:
Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.


Affected Packages:

firefox


Issue Correction:
Run dnf update firefox --releasever 2027.0.20261102 or dnf update --advisory ALAS2027-2026-258 --releasever 2027.0.20261102 to update your system.

New Packages:
aarch64:
    firefox-debuginfo-153.5.0-1.amzn2027.0.1.aarch64
    firefox-153.5.0-1.amzn2027.0.1.aarch64
    firefox-debugsource-153.5.0-1.amzn2027.0.1.aarch64

src:
    firefox-153.5.0-1.amzn2027.0.1.src

x86_64:
    firefox-debuginfo-153.5.0-1.amzn2027.0.1.x86_64
    firefox-153.5.0-1.amzn2027.0.1.x86_64
    firefox-debugsource-153.5.0-1.amzn2027.0.1.x86_64

Additional References

Red Hat: CVE-2026-109770, CVE-2026-109766, CVE-2026-109724, CVE-2026-109754, CVE-2026-109726, CVE-2026-109725, CVE-2026-109722, CVE-2026-109737, CVE-2026-109729, CVE-2026-109743, CVE-2026-109715, CVE-2026-109713, CVE-2026-109760, CVE-2026-109721, CVE-2026-109706, CVE-2026-109757, CVE-2026-109778, CVE-2026-109753, CVE-2026-109712, CVE-2026-109738, CVE-2026-109716, CVE-2026-109744, CVE-2026-109734, CVE-2026-109777, CVE-2026-109765, CVE-2026-109719, CVE-2026-109733, CVE-2026-109723, CVE-2026-109751, CVE-2026-109764, CVE-2026-109709, CVE-2026-109752, CVE-2026-109736, CVE-2026-109711, CVE-2026-109783, CVE-2026-109728, CVE-2026-100787, CVE-2026-109762, CVE-2026-109763, CVE-2026-109717, CVE-2026-109775, CVE-2026-109782, CVE-2026-100766, CVE-2026-109705, CVE-2026-109727, CVE-2026-109741, CVE-2026-109732, CVE-2026-109720, CVE-2026-109776, CVE-2026-109730, CVE-2026-109704, CVE-2026-109767, CVE-2026-109781, CVE-2026-109708, CVE-2026-109718, CVE-2026-109707, CVE-2026-109731, CVE-2026-109710, CVE-2026-109759, CVE-2026-109745, CVE-2026-109756, CVE-2026-109742

Mitre: CVE-2026-109770, CVE-2026-109766, CVE-2026-109724, CVE-2026-109754, CVE-2026-109726, CVE-2026-109725, CVE-2026-109722, CVE-2026-109737, CVE-2026-109729, CVE-2026-109743, CVE-2026-109715, CVE-2026-109713, CVE-2026-109760, CVE-2026-109721, CVE-2026-109706, CVE-2026-109757, CVE-2026-109778, CVE-2026-109753, CVE-2026-109712, CVE-2026-109738, CVE-2026-109716, CVE-2026-109744, CVE-2026-109734, CVE-2026-109777, CVE-2026-109765, CVE-2026-109719, CVE-2026-109733, CVE-2026-109723, CVE-2026-109751, CVE-2026-109764, CVE-2026-109709, CVE-2026-109752, CVE-2026-109736, CVE-2026-109711, CVE-2026-109783, CVE-2026-109728, CVE-2026-100787, CVE-2026-109762, CVE-2026-109763, CVE-2026-109717, CVE-2026-109775, CVE-2026-109782, CVE-2026-100766, CVE-2026-109705, CVE-2026-109727, CVE-2026-109741, CVE-2026-109732, CVE-2026-109720, CVE-2026-109776, CVE-2026-109730, CVE-2026-109704, CVE-2026-109767, CVE-2026-109781, CVE-2026-109708, CVE-2026-109718, CVE-2026-109707, CVE-2026-109731, CVE-2026-109710, CVE-2026-109759, CVE-2026-109745, CVE-2026-109756, CVE-2026-109742