CVE-2023-24936 — .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Affected: Microsoft Visual Studio 2022 version 17.2, Microsoft Visual Studio 2022 version 17.0, Microsoft Visual Studio 2022 version 17.4, Microsoft .NET 6.0, Microsoft .NET 7.0, Microsoft Visual Studio 2022 version 17.6, Microsoft PowerShell 7.2, Microsoft PowerShell 7.3, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.8 and 10 more

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

USN-6161-1 — dotnet6, dotnet7 vulnerabilities

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7

It was discovered that .NET did not properly enforce certain restrictions when deserializing a DataSet or DataTable from XML. An attacker could possibly use this issue to elevate their privileges. (CVE-2023-24936)

Kevin Jones discovered that .NET did not properly handle the AIA fetching process for X.509 client certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-29331)

Kalle Niemitalo discovered that the .NET package manager, NuGet, was susceptible to a potential race condition. An attacker could possibly use this issue to perform remote code execution. (CVE-2023-29337)

Tom Deseyn discovered that .NET did not properly process certain arguments when extracting the contents of a tar file. An attacker could possibly use this issue to elevate their privileges. This issue only affected the dotnet7 package. (CVE-2023-32032)

It was discovered that .NET did not properly handle memory in certain circumstances. An attacker could possibly use this issue to cause a denial of service or perform remote code execution. (CVE-2023-33128)

Most recent entries from all

CVE-2023-24936 — .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

USN-6161-1 — dotnet6, dotnet7 vulnerabilities