Most recent entries from all

ALSA-2022:6911 — Moderate: .NET 6.0 security and bugfix update

Affected: AlmaLinux:8: aspnetcore-runtime-6.0, AlmaLinux:8: aspnetcore-targeting-pack-6.0, AlmaLinux:8: dotnet, AlmaLinux:8: dotnet-apphost-pack-6.0, AlmaLinux:8: dotnet-host, AlmaLinux:8: dotnet-hostfxr-6.0, AlmaLinux:8: dotnet-runtime-6.0, AlmaLinux:8: dotnet-sdk-6.0, AlmaLinux:8: dotnet-sdk-6.0-source-built-artifacts, AlmaLinux:8: dotnet-targeting-pack-6.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.110 and .NET Runtime 6.0.10.

Security Fix(es):

* dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-06453

BIT-dotnet-2022-41032 — NuGet Client Elevation of Privilege Vulnerability

Affected: Bitnami: dotnet

NuGet Client Elevation of Privilege Vulnerability

certfr-2022-avi-908 — Une vulnérabilité a été corrigée dans Microsoft .Net. Elle permet à un attaquant de provoqu…

certfr-2022-avi-908

CLEANSTART-2024-PD73825 — NuGet Client Elevation of Privilege Vulnerability

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime

CVE-2022-41032 affects multiple packages. NuGet Client Elevation of Privilege Vulnerability See references for individual vulnerability details.

EUVD-2026-220095

fkie_cve-2022-41032

NuGet Client Elevation of Privilege Vulnerability

GHSA-g3q9-xf95-8hp5 — NuGet Elevation of Privilege Vulnerability

Affected: NuGet: NuGet.Commands, NuGet: NuGet.CommandLine, NuGet: NuGet.Protocol

## Description

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0.0-rc, .NET 6.0, .NET Core 3.1, and NuGet (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET 7.0.0-rc.1, .NET 6.0, .NET Core 3.1, and NuGet clients (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol) where a malicious actor could cause a user to execute arbitrary code.

## Affected software

### NuGet & NuGet Packages

- Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.3.0 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.2.1 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.0.2 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.11.2 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.9.2 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.7.2 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 4.9.5 version or earlier.

### .NET SDK(s)

- Any .NET 6.0 application running on .NET 6.0.9 or earlier. - Any .NET 3.1 application running on .NET Core 3.1.29 or earlier.

## Patches

To fix the issue, please install the latest version of .NET 6.0 or .NET…

gsd-2022-41032

ICSA-23-320-12 — Siemens PNI

.NET and Visual Studio Information Disclosure Vulnerability. zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). NuGet Client Elevation of Privilege Vulnerability. .NET and Visual Studio Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability .NET DLL Hijacking Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Elevation of Privilege Vulnerability .NET and Visual Studio Remote Code Execution Vulnerability .NET and Visual Studio Remote Code Execution Vulnerability .NET and Visual Studio Elevation of Privilege Vulnerability

msrc_CVE-2022-41032 — NuGet Client Elevation of Privilege Vulnerability

msrc_CVE-2022-41032

RHSA-2022:6911 — Red Hat Security Advisory: .NET 6.0 security and bugfix update

dotnet: Nuget cache poisoning on Linux via world-writable cache directory

RHSA-2022:6914 — Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update

dotnet: Nuget cache poisoning on Linux via world-writable cache directory

UBUNTU-CVE-2022-41032

Affected: Ubuntu:22.04:LTS: dotnet6

NuGet Client Elevation of Privilege Vulnerability

WID-SEC-W-2022-1683 — Microsoft Developer Tools: Mehrere Schwachstellen

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Developer Tools ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und vertrauliche Informationen offenzulegen.