Vulnerabilities fixed in Microsoft Developer Tools

Microsoft fixed vulnerabilities in Visual Studio and .NET A malicious party could exploit the vulnerabilities to cause a denial-of-service, grant themselves elevated privileges and/or execute arbitrary code with developer privileges. Because developers tend to work under elevated privileges, it...

Security Update for Microsoft .NET 8 Core (January 2025)

The version of Microsoft .NET 8 Core installed on the remote host is prior to 8.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21172 - .NET Elevation of Privilege Vulnerabilit...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2025-063)

The version of kernel installed on the remote host is prior to 5.15.178-120.178. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-063 advisory. Integer Overflow or Wraparound vulnerability in Linux kernel on x86 and ARM md, raid, raid5 modules allo...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2025-844)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-844 advisory. .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21172 .NET Elevation of Privilege Vulnerability CVE-2025-21173 .NET, .NET Framework, and Visual Studio Remote Code Execution...

RockyLinux 8 : .NET 9.0 (RLSA-2025:0382)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:0382 advisory. dotnet: .NET Remote Code Execution Vulnerability CVE-2025-21171 dotnet: .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21172 dotnet:...

Oracle Linux 8 : .NET / 9.0 (ELSA-2025-0382)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-0382 advisory. - .NET Remote Code Execution Vulnerability CVE-2025-21171 - .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2025-21176 ...

AlmaLinux 8 : .NET 9.0 (ALSA-2025:0382)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:0382 advisory. dotnet: .NET Remote Code Execution Vulnerability CVE-2025-21171 dotnet: .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21172 dotnet:...

Remote Code Execution (RCE)

.NET 8.0 and .NET 9.0 are vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation or handling of files loaded in Visual Studio, allowing specially crafted files to exploit the system...

Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : .NET vulnerabilities (USN-7210-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7210-1 advisory. It was discovered that .NET did not properly handle input provided to its Convert.TryToHexString method. An attacker could possibly u...

USN-7210-1: .NET vulnerabilities

It was discovered that .NET did not properly handle input provided to its Convert.TryToHexString method. An attacker could possibly use this issue to execute arbitrary code. CVE-2025-21171 It was discovered that .NET did not properly handle an integer overflow when processing certain specially...

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.102 and .NET Runtime 9.0.1...

RHEL 8 : .NET 9.0 (RHSA-2025:0382)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0382 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

RHEL 8 : .NET 8.0 (RHSA-2025:0381)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0381 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

.NET and Visual Studio Remote Code Execution Vulnerability

...

Security Updates for Microsoft Visual Studio 2019 16.11 / 2017 15.9 Products (January 2025)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including: - An undisclosed .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability CVE-2025-21176 - An undisclosed Visual Studio Remote Code Execution...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2024-776)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-776 advisory. .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43483 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43484 .NET and Visual...

USN-7105-1: .NET vulnerabilities

It was discovered that the NrbfDecoder component in .NET did not properly handle an instance of a type confusion vulnerability. An authenticated attacker could possibly use this issue to gain the privileges of another user and execute arbitrary code. CVE-2024-43498 It was discovered that the...

Ubuntu 24.10 : .NET vulnerabilities (USN-7105-1)

The remote Ubuntu 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7105-1 advisory. It was discovered that the NrbfDecoder component in .NET did not properly handle an instance of a type confusion vulnerability. An authenticated attacker cou...

RockyLinux 8 : .NET 8.0 (RLSA-2024:7868)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:7868 advisory. dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution CVE-2024-38229 dotnet: Multiple .NET components...

USN-7058-1: .NET vulnerabilities

Brennan Conroy discovered that the .NET Kestrel web server did not properly handle closing HTTP/3 streams under certain circumstances. An attacker could possibly use this issue to achieve remote code execution. This vulnerability only impacted .NET8. CVE-2024-38229 It was discovered that .NET...