ALAS2023-2026-3242 — Moderate: nss security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-16389: Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153. CVE-2026-12318: Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Fixed packages 21

Release	Package	Fixed in
Amazon Linux · 2023	nspr	0:4.39.0-1.amzn2023.0.2
Amazon Linux · 2023	nspr-debuginfo	0:4.39.0-1.amzn2023.0.2
Amazon Linux · 2023	nspr-devel	0:4.39.0-1.amzn2023.0.2
Amazon Linux · 2023	nss	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-debuginfo	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-debugsource	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-devel	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-pkcs11-devel	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-softokn	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-softokn-debuginfo	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-softokn-devel	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-softokn-freebl	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-softokn-freebl-debuginfo	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-softokn-freebl-devel	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-sysinit	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-sysinit-debuginfo	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-tools	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-tools-debuginfo	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-util	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-util-debuginfo	0:3.124.0-1.amzn2023.0.2
Amazon Linux · 2023	nss-util-devel	0:3.124.0-1.amzn2023.0.2

Vulnerabilities 2

Critical 9.8

CVE-2026-16389

Incorrect boundary conditions, integer overflow in the Libraries component in NSS

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jul 21, 2026
High 7.3

CVE-2026-12318

Incorrect boundary conditions in the Libraries component in NSS

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jun 16, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2026-12318.html
web
https://alas.aws.amazon.com/cve/html/CVE-2026-16389.html