Most recent entries from all

ALSA-2023:3581 — Important: .NET 6.0 security, bug fix, and enhancement update

2026-10-02T14:54:37.192772+00:00

Affected: AlmaLinux:9: aspnetcore-runtime-6.0, AlmaLinux:9: aspnetcore-targeting-pack-6.0, AlmaLinux:9: dotnet-apphost-pack-6.0, AlmaLinux:9: dotnet-hostfxr-6.0, AlmaLinux:9: dotnet-runtime-6.0, AlmaLinux:9: dotnet-sdk-6.0, AlmaLinux:9: dotnet-sdk-6.0-source-built-artifacts, AlmaLinux:9: dotnet-targeting-pack-6.0, AlmaLinux:9: dotnet-templates-6.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.118 and .NET Runtime 6.0.18.

The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.118). (BZ#2212379)

Security Fix(es):

* dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331) * dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337) * dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128) * dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-11602

2026-10-02T14:54:37.192845+00:00

bdu:2024-11602

certfr-2023-avi-0465 — De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent…

2026-10-02T14:54:37.192862+00:00

certfr-2023-avi-0465

CLEANSTART-2025-EH90452 — NuGet Client Remote Code Execution Vulnerability

2026-10-02T14:54:37.192877+00:00

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime

CVE-2023-29337 affects multiple packages. NuGet Client Remote Code Execution Vulnerability See references for individual vulnerability details.

EUVD-2026-208078

2026-10-02T14:54:37.192899+00:00

EUVD-2026-208078

fkie_cve-2023-29337

2026-10-02T14:54:37.192910+00:00

NuGet Client Remote Code Execution Vulnerability

GHSA-6qmf-mmc7-6c2p — NuGet Client Remote Code Execution Vulnerability

2026-10-02T14:54:37.192928+00:00

Affected: NuGet: Microsoft.Build.NuGetSdkResolver, NuGet: NuGet.PackageManagement, NuGet: NuGet.Commands, NuGet: NuGet.CommandLine, NuGet: NuGet.Common, NuGet: NuGet.Protocol

### Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET and NuGet on Linux. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET 6.0, .NET 7.0 and NuGet(nuget.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement) where a potential race condition that can lead to a symlink attack on Linux. Non-Linux platforms are not affected.

### Affected software This issue only affects Linux systems.

#### NuGet & NuGet Packages

- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.6.0 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.5.0 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.4.1 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.3.2 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.2.3 version or earlier. - Any NuGet.ex…

gsd-2023-29337

2026-10-02T14:54:37.192994+00:00

gsd-2023-29337

msrc_CVE-2023-29337 — NuGet Client Remote Code Execution Vulnerability

2026-10-02T14:54:37.193006+00:00

msrc_CVE-2023-29337

RHSA-2023:3580 — Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

2026-10-02T14:54:37.193021+00:00

dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML dotnet: .NET Kestrel: Denial of Service processing X509 Certificates dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption

RHSA-2023:3581 — Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

2026-10-02T14:54:37.193040+00:00

UBUNTU-CVE-2023-29337

2026-10-02T14:54:37.193058+00:00

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7

NuGet Client Remote Code Execution Vulnerability

WID-SEC-W-2023-1446 — Microsoft Developer Tools: Mehrere Schwachstellen

2026-10-02T14:54:37.193076+00:00

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft .NET Framework, Microsoft Azure DevOps Server, Microsoft NuGet, Microsoft Visual Studio und Microsoft Visual Studio Code ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen, seine Rechte zu erweitern und Daten zu manipulieren.