Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
33 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Microsoft Security Advisory CVE-2023-28260: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET running on Windows where a runtime DLL can be loaded from an unexpected location, resulting in remote code execution. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/250 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.4 or earlier. Any .NET 6.0 application running on .NET 6.0.15 or earlier. Advisory FAQ <a name="how-affected"</aHow do I know if I am affected? If you…
Recommended action: Upgrade to 7.0.5 or 6.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-21808: .NET Remote Code Execution Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in how .NET reads debugging symbols, where reading a malicious symbols file may result in remote code execution. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/82112 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 7.0 application running on .NET 7.0.2 or earlier. Any .NET 6.0 application running on .NET 6.0.13 or earlier. If your application uses the following package versions, ensure you update to the latest version…
Recommended action: Upgrade to 7.0.3 or 6.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft Security Advisory CVE-2023-21538: .NET Denial of Service Vulnerability <a name="executive-summary"</aExecutive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 6.0 where a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends an invalid request to an exposed endpoint. Discussion Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/80449 <a name="mitigation-factors"</aMitigation factors Microsoft has not identified any mitigating factors for this vulnerability. <a name="affected-software"</aAffected software Any .NET 6.0 application running on .NET 6.0.12 or earlier. If your application uses the following package versions, ensure you update to the latest…
Recommended action: Upgrade to 6.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame. Patches If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0. If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1. If you're using .NET Core 2.1, you should…
Recommended action: Upgrade to 5.0.9 or 3.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1 and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 when dumps created by the tool to collect crash dumps and dumps on demand are created with global read permissions on Linux and macOS. Patches If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0. If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1. If you're using .NET Core 2.1, you should…
Recommended action: Upgrade to 5.0.9 or 3.1.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
.NET Core and Visual Studio Denial of Service Vulnerability due to a vulnerability which exists when creating HTTPS web request during X509 certificate chain building.
Recommended action: Upgrade to 5.0.3 or 3.1.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
Recommended action: Upgrade to 3.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.
Recommended action: Upgrade to 3.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.