Linux · Security advisory · January 16, 2025

ALSA-2025:0381: Security update for 12 packages

ALSA-2025:0381, released January 16, 2025, fixes 4 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0238

83rd percentile

Priority of the 4 CVEs

Patch now 0
                                Urgent 0
                                High 3
                                Routine 1

Fixed package versions

Product	Release	Fixed in
aspnetcore-runtime-8.0	almalinux 8	8.0.12-1.el8_10
aspnetcore-runtime-dbg-8.0	almalinux 8	8.0.12-1.el8_10
aspnetcore-targeting-pack-8.0	almalinux 8	8.0.12-1.el8_10
dotnet-apphost-pack-8.0	almalinux 8	8.0.12-1.el8_10
dotnet-hostfxr-8.0	almalinux 8	8.0.12-1.el8_10
dotnet-runtime-8.0	almalinux 8	8.0.12-1.el8_10
dotnet-runtime-dbg-8.0	almalinux 8	8.0.12-1.el8_10
dotnet-sdk-8.0	almalinux 8	8.0.112-1.el8_10
dotnet-sdk-8.0-source-built-artifacts	almalinux 8	8.0.112-1.el8_10
dotnet-sdk-dbg-8.0	almalinux 8	8.0.112-1.el8_10
dotnet-targeting-pack-8.0	almalinux 8	8.0.12-1.el8_10
dotnet-templates-8.0	almalinux 8	8.0.112-1.el8_10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2025-21176	.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability	8.8	0.0238	Exploitation Less Likely
High	CVE-2025-21172	.NET and Visual Studio Remote Code Execution Vulnerability	7.5	0.0184	Exploitation Less Likely
High	CVE-2025-21173	.NET Elevation of Privilege Vulnerability	7.3	0.0130	Exploitation Less Likely
Routine	CVE-2024-11831	aspnetcore-runtime-8.0: .NET is a managed-software framework	5.4	0.0112	None reported

Also fixes CVE-2025-21176

KB5049993
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2016 and 5 more
KB5050013
Microsoft .NET Framework 4.6/4.6.2 on Windows 10 for 32-bit Systems, Microsoft .NET Framework 4.6/4.6.2 on Windows 10 for x64-based Systems, Windows 10 for 32-bit Systems and 1 more
RLSA-2025:0382
dotnet9.0 on rocky 8
ELSA-2025-0382
aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 and 13 more on ol 8
ALSA-2025:0382
aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 and 13 more on almalinux 8
RHSA-2025:0381
aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 and 9 more on RHEL 8
RHSA-2025:0382
aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 and 13 more on RHEL 8
aspnetcore-runtime-9.0 9.0.1-0ubuntu1~24.10.1
aspnetcore-runtime-9.0 on Ubuntu 24.10 (oracular)

Vendor advisory

https://osv.dev/vulnerability/ALSA-2025:0381

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo