[USN-6278-2] .NET vulnerabilities
ian.constantin at canonical.com
Thu Aug 10 20:47:15 UTC 2023
Ubuntu Security Notice USN-6278-2
August 10, 2023
dotnet6, dotnet7 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Several security issues were fixed in .NET.
- dotnet6: dotNET CLI tools and runtime
- dotnet7: dotNET CLI tools and runtime
USN-6278-1 fixed several vulnerabilities in .NET. This update
provides the corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that .NET did properly handle the execution of
certain commands. An attacker could possibly use this issue to
achieve remote code execution. (CVE-2023-35390)
Benoit Foucher discovered that .NET did not properly implement the
QUIC stream limit in HTTP/3. An attacker could possibly use this
issue to cause a denial of service. (CVE-2023-38178)
It was discovered that .NET did not properly handle the disconnection
of potentially malicious clients interfacing with a Kestrel server. An
attacker could possibly use this issue to cause a denial of service.
The problem can be corrected by updating your system to the following
Ubuntu 22.04 LTS:
In general, a standard system update will make all the necessary changes.
CVE-2023-35390, CVE-2023-38178, CVE-2023-38180
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 665 bytes
Desc: OpenPGP digital signature
More information about the ubuntu-security-announce