Lucene search
UbuntuUSN-6278-1HistoryAug 08, 2023 - 12:00 a.m.
.NET vulnerabilities
2023-08-0800:00:00
ubuntu.com
27
.net
vulnerabilities
dotnet6
dotnet7
ubuntu 23.04
remote code execution
cve-2023-35390
quic stream limit
denial of service
cve-2023-38178
kestrel server
cve-2023-38180
http/3
runtime
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
8.4 High
AI Score
Confidence
High
Releases
- Ubuntu 23.04
Packages
- dotnet6 - dotNET CLI tools and runtime
- dotnet7 - dotNET CLI tools and runtime
Details
It was discovered that .NET did not properly handle the execution
of certain commands. An attacker could possibly use this issue to
achieve remote code execution. (CVE-2023-35390)
Benoit Foucher discovered that .NET did not properly implement the
QUIC stream limit in HTTP/3. An attacker could possibly use this
issue to cause a denial of service. (CVE-2023-38178)
It was discovered that .NET did not properly handle the disconnection
of potentially malicious clients interfacing with a Kestrel server. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-38180)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 23.04 | noarch | aspnetcore-runtime-6.0 | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | aspnetcore-targeting-pack-6.0 | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-apphost-pack-6.0 | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-apphost-pack-6.0-dbgsym | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-host | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-host-dbgsym | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-hostfxr-6.0 | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-hostfxr-6.0-dbgsym | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-runtime-6.0 | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | dotnet-runtime-6.0-dbgsym | < 6.0.121-0ubuntu1~23.04.1 | UNKNOWN |
Related
osv
osv
dotnet6, dotnet7 vulnerabilities
2023-08-10 19:34:11
Important: .NET 6.0 security, bug fix, and enhancement update
2023-08-14 00:00:00
Important: .NET 7.0 security, bug fix, and enhancement update
2023-08-14 00:00:00
ubuntu
ubuntu
.NET vulnerabilities
2023-08-10 00:00:00
nessus
nessus
Ubuntu 22.04 LTS : .NET vulnerabilities (USN-6278-2)
2023-08-11 00:00:00
Ubuntu 23.04 : .NET vulnerabilities (USN-6278-1)
2023-08-09 00:00:00
Security Update for Microsoft .NET Core (August 2023)
2023-08-08 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-6278-2)
2023-08-11 00:00:00
Ubuntu: Security Advisory (USN-6278-1)
2023-08-09 00:00:00
Fedora: Security Advisory for dotnet7.0 (FEDORA-2023-cbc688b8ca)
2023-08-20 00:00:00
mskb
mskb
.NET 6.0 Update - August 8, 2023 (KB5029688)
2023-08-08 07:00:00
.NET 7.0 Update - August 8, 2023 (KB5029689)
2023-08-08 07:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: dotnet6.0-6.0.121-1.fc37
2023-08-20 00:45:06
[SECURITY] Fedora 37 Update: dotnet7.0-7.0.110-1.fc37
2023-08-20 00:45:07
[SECURITY] Fedora 38 Update: dotnet6.0-6.0.121-1.fc38
2023-08-20 00:49:10
almalinux
almalinux
Important: .NET 6.0 security, bug fix, and enhancement update
2023-08-14 00:00:00
Important: .NET 7.0 security, bug fix, and enhancement update
2023-08-14 00:00:00
Important: .NET 7.0 security, bug fix, and enhancement update
2023-08-14 00:00:00
redhat
redhat
(RHSA-2023:4641) Important: rh-dotnet60-dotnet security, bug fix, and enhancement update
2023-08-14 13:47:20
(RHSA-2023:4640) Important: .NET 6.0 security update
2023-08-14 13:46:13
oraclelinux
oraclelinux
.NET 7.0 security, bug fix, and enhancement update
2023-08-15 00:00:00
.NET 7.0 security, bug fix, and enhancement update
2023-08-16 00:00:00
.NET 6.0 security, bug fix, and enhancement update
2023-08-15 00:00:00
ibm
ibm
rocky
rocky
.NET 7.0 security, bug fix, and enhancement update
2023-10-06 23:10:12
.NET 6.0 security, bug fix, and enhancement update
2023-10-06 23:10:12
kaspersky
kaspersky
KLA51717 Multiple vulnerabilities in Microsoft Developer Tools
2023-08-08 00:00:00
veracode
veracode
Denial Of Service (DoS)
2023-08-09 19:30:29
Remote Code Execution (RCE)
2023-08-10 02:58:02
Denial Of Service (DoS)
2023-08-09 23:29:58
cvelist
cvelist
CVE-2023-35390 .NET and Visual Studio Remote Code Execution Vulnerability
2023-08-08 17:08:54
CVE-2023-38180 .NET and Visual Studio Denial of Service Vulnerability
2023-08-08 18:52:31
CVE-2023-38178 .NET Core and Visual Studio Denial of Service Vulnerability
2023-08-08 17:08:57
alpinelinux
alpinelinux
ubuntucve
ubuntucve
github
github
.NET Denial of Service Vulnerability
2023-08-09 12:56:43
.NET Remote Code Execution Vulnerability
2023-08-09 13:15:38
.NET Denial of Service Vulnerability
2023-08-09 13:04:54
attackerkb
attackerkb
CVE-2023-38180
2023-08-08 00:00:00
cve
cve
prion
prion
Remote code execution
2023-08-08 18:15:00
Denial of service
2023-08-08 19:15:00
Denial of service
2023-08-08 18:15:00
mscve
mscve
.NET and Visual Studio Remote Code Execution Vulnerability
2023-08-08 07:00:00
.NET and Visual Studio Denial of Service Vulnerability
2023-08-08 07:00:00
.NET Core and Visual Studio Denial of Service Vulnerability
2023-08-08 07:00:00
redhatcve
redhatcve
cisa_kev
cisa_kev
Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
2023-08-09 00:00:00
thn
thn
Microsoft Releases Patches for 74 New Vulnerabilities in August Update
2023-08-09 04:26:00
krebs
krebs
Microsoft Patch Tuesday, August 2023 Edition
2023-08-09 02:22:57
malwarebytes
malwarebytes
August Patch Tuesday stops actively exploited attack chain and more
2023-08-10 01:00:00
avleonov
avleonov
qualysblog
qualysblog
Microsoft and Adobe Patch Tuesday, August 2023 Security Update Review
2023-08-08 20:35:59
talosblog
talosblog
Six critical vulnerabilities included in August’s Microsoft security update
2023-08-08 19:25:42
rapid7blog
rapid7blog
Patch Tuesday - August 2023
2023-08-08 21:11:35
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
8.4 High
AI Score
Confidence
High
Related for USN-6278-1