Linux · Security advisory · June 15, 2023

ELSA-2023-3581: Security update for 9 packages

ELSA-2023-3581, released June 15, 2023, fixes 4 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0263

85th percentile

Priority of the 4 CVEs

Patch now 0
                                Urgent 0
                                High 4
                                Routine 0

Fixed package versions

Product	Release	Fixed in
aspnetcore-runtime-6.0	ol 9	0:6.0.18-1.0.1.el9_2
aspnetcore-targeting-pack-6.0	ol 9	0:6.0.18-1.0.1.el9_2
dotnet-apphost-pack-6.0	ol 9	0:6.0.18-1.0.1.el9_2
dotnet-hostfxr-6.0	ol 9	0:6.0.18-1.0.1.el9_2
dotnet-runtime-6.0	ol 9	0:6.0.18-1.0.1.el9_2
dotnet-sdk-6.0	ol 9	0:6.0.118-1.0.1.el9_2
dotnet-sdk-6.0-source-built-artifacts	ol 9	0:6.0.118-1.0.1.el9_2
dotnet-targeting-pack-6.0	ol 9	0:6.0.18-1.0.1.el9_2
dotnet-templates-6.0	ol 9	0:6.0.118-1.0.1.el9_2

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2023-29331	.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability	7.5	0.0263	Exploitation Less Likely
High	CVE-2023-24936	.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability	7.5	0.0156	Exploitation Less Likely
High	CVE-2023-29337	NuGet Client Remote Code Execution Vulnerability	7.5	0.0115	Exploitation Less Likely
High	CVE-2023-33128	.NET and Visual Studio Remote Code Execution Vulnerability	7.5	0.0100	Exploitation Less Likely

Also fixes CVE-2023-29331

KB5027219
Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems and 8 more
PowerShell Preview 7.4.0.1
PowerShell Preview
KB5027230
Microsoft .NET Framework 3.5 and 4.6.2 on Windows 10 for 32-bit Systems, Microsoft .NET Framework 3.5 and 4.6.2 on Windows 10 for x64-based Systems, Windows 10 for 32-bit Systems and 1 more
KB5027798
.NET 7.0
KB5027119
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 22H2 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 22H2 for x64-based Systems
KB5027531
Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1, Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation), Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 and 3 more
KB5027532
Microsoft .NET Framework 3.5 on Windows Server 2012, Microsoft .NET Framework 3.5 on Windows Server 2012 (Server Core installation), Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 and 3 more
KB5027533
Microsoft .NET Framework 3.5 on Windows Server 2012 R2, Microsoft .NET Framework 3.5 on Windows Server 2012 R2 (Server Core installation), Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 and 3 more

Vendor advisory

https://linux.oracle.com/errata/ELSA-2023-3581.html

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo