Firefox Security Update — AlmaLinux 8 (ALSA-2026:19588)

ALSA-2026:19588 updates Firefox on AlmaLinux 8, fixing CVE-2026-7323, CVE-2026-7320, CVE-2026-7322 and CVE-2026-7321 — memory-safety bugs fixed in Firefox ESR 115.33 (CWE-119 boundary class), aggregate CVSS 7.3. Update with dnf update firefox and restart the browser.

High 7.3 CVSS 2026-11-05

AlmaLinux 8

What this means under a SharedLicense license

Memory-safety bugs in the browser engine are the standard malicious-content-to-code-execution chain — relevant wherever Firefox renders untrusted web content.

Type:

security

Severity:

important

Release date:

2026-11-05

Description:

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)
* firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)
* firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)
* firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	firefox-140.10.1-1.el8_10.alma.1.aarch64.rpm	d1564915c3cc3c7d9b80986803c4d16baa06d2d401add5bb08d492bee35c470f
ppc64le	firefox-140.10.1-1.el8_10.alma.1.ppc64le.rpm	3f4489fc358cf9a28b91f6fb323870173130981b0dc25fa86b41f608b3fa8370
s390x	firefox-140.10.1-1.el8_10.alma.1.s390x.rpm	a91a0957df813c308cc1d63d5c1dac0517e66e3f9d9e666b4e2818a8d5c681dc
x86_64	firefox-140.10.1-1.el8_10.alma.1.x86_64.rpm	919c1bacc06902441758520bc3e830afe09777451546f99af6fbc938b9002ae4

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is ALSA-2026:19588?

It is AlmaLinux's Firefox erratum for AlmaLinux 8, fixing CVE-2026-7323, CVE-2026-7320, CVE-2026-7322 and CVE-2026-7321 — memory-safety bugs fixed in Firefox ESR 115.33, aggregate CVSS 7.3 (CWE-119).

Who is affected?

AlmaLinux 8 systems with Firefox installed — workstations and any automation rendering web content.

How do I apply the fix?

Run dnf update firefox and restart the browser; verify the version in its About dialog.

Why does Firefox ESR get these memory-safety updates?

ESR receives security-only fixes from the current release line — memory-safety bugs fixed in the main release are backported to ESR, which is the branch AlmaLinux packages.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System