ALAS2023-2023-369 — Important: dotnet6.0 security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-36799: .NET Core and Visual Studio Denial of Service Vulnerability CVE-2023-36796: Visual Studio Remote Code Execution Vulnerability CVE-2023-36794: Visual Studio Remote Code Execution Vulnerability CVE-2023-36793: Visual Studio Remote Code Execution Vulnerability CVE-2023-36792: Visual Studio Remote Code Execution Vulnerability

Fixed packages 19

Release	Package	Fixed in
Amazon Linux · 2023	aspnetcore-runtime-6.0	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	aspnetcore-targeting-pack-6.0	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet	0:6.0.122-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-apphost-pack-6.0	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-apphost-pack-6.0-debuginfo	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-host	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-host-debuginfo	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-hostfxr-6.0	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-hostfxr-6.0-debuginfo	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-runtime-6.0	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-runtime-6.0-debuginfo	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0	0:6.0.122-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0-debuginfo	0:6.0.122-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-sdk-6.0-source-built-artifacts	0:6.0.122-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-targeting-pack-6.0	0:6.0.22-1.amzn2023.0.1
Amazon Linux · 2023	dotnet-templates-6.0	0:6.0.122-1.amzn2023.0.1
Amazon Linux · 2023	dotnet6.0-debuginfo	0:6.0.122-1.amzn2023.0.1
Amazon Linux · 2023	dotnet6.0-debugsource	0:6.0.122-1.amzn2023.0.1
Amazon Linux · 2023	netstandard-targeting-pack-2.1	0:6.0.122-1.amzn2023.0.1

Vulnerabilities 5

High 7.8

CVE-2023-36792

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36793

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36794

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36796

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
Medium 6.5

CVE-2023-36799

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Sep 12, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-36792.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-36793.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-36794.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-36796.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-36799.html