KLA19246 Multiple vulnerabilities in Microsoft Developer Tools

Detect date:

09/13/2022

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service.

Affected products:

Visual Studio 2022 for Mac version 17.3
Microsoft Visual Studio 2022 version 17.3
Microsoft .NET Framework 3.5 AND 4.7.2
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft .NET Framework 4.8
Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft Visual Studio 2022 version 17.2
Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)
Microsoft .NET Framework 3.5 AND 4.8.1
.NET 6.0
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 4.6
.NET Core 3.1
Microsoft .NET Framework 4.8.1
Visual Studio Code
Microsoft .NET Framework 3.5 AND 4.8
Microsoft Visual Studio 2022 version 17.0
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 2.0 Service Pack 2

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2022-38020
CVE-2022-26929
CVE-2022-38013

Impacts:

ACE

Related products:

Microsoft .NET Framework

CVE-IDS:

CVE-2022-380207.3High
CVE-2022-269297.8Critical
CVE-2022-380137.5Critical

KB list:

5017327
5017500
5017497
5017915
5017903
5017501
5017499

Microsoft official advisories: