Most recent entries from all

ALSA-2024:2842 — Important: .NET 8.0 security update

Affected: AlmaLinux:9: aspnetcore-runtime-8.0, AlmaLinux:9: aspnetcore-runtime-dbg-8.0, AlmaLinux:9: aspnetcore-targeting-pack-8.0, AlmaLinux:9: dotnet-apphost-pack-8.0, AlmaLinux:9: dotnet-host, AlmaLinux:9: dotnet-hostfxr-8.0, AlmaLinux:9: dotnet-runtime-8.0, AlmaLinux:9: dotnet-runtime-dbg-8.0, AlmaLinux:9: dotnet-sdk-8.0, AlmaLinux:9: dotnet-sdk-8.0-source-built-artifacts and 4 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.105 and .NET Runtime 8.0.5.

Security Fix(es):

* dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-03969

BIT-dotnet-2024-30045 — .NET and Visual Studio Remote Code Execution Vulnerability

Affected: Bitnami: dotnet

.NET and Visual Studio Remote Code Execution Vulnerability

certfr-2024-avi-0401 — Une vulnérabilité a été découverte dans Microsoft .Net. Elle permet à un attaquant de provo…

certfr-2024-avi-0401

CLEANSTART-2025-OR85349 — .NET and Visual Studio Remote Code Execution Vulnerability

Affected: CleanStart: dotnet8-runtime

Security vulnerability affects the dotnet8-runtime package. .

EUVD-2026-236825

fkie_cve-2024-30045

.NET and Visual Studio Remote Code Execution Vulnerability

GHSA-7fcr-8qw6-92fr — Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability

Affected: NuGet: Microsoft.NETCore.App.Runtime.linux-arm, NuGet: Microsoft.NETCore.App.Runtime.linux-arm64, NuGet: Microsoft.NETCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NETCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NETCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NETCore.App.Runtime.linux-x64, NuGet: Microsoft.NETCore.App.Runtime.osx-arm64, NuGet: Microsoft.NETCore.App.Runtime.osx-x64, NuGet: Microsoft.NETCore.App.Runtime.win-arm, NuGet: Microsoft.NETCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Remote Code Execution vulnerability exists in .NET 7.0 and .NET 8.0 where a stack buffer overrun occurs in .NET Double Parse routine.

## Discussion

Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/102206

## <a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 7.0 application running on .NET 7.0.18 or earlier. * Any .NET 8.0 application running on .NET 8.0.4 or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### <a name=".NET 7"></a>.NET 7

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | <= 7.0.18 | 7.0.19 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm…

gsd-2024-30045

ICSA-24-228-02 — Siemens INTRALOG WMS

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability Find more information about this vulnerability at <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0056>. Impact: Decryption or modification of the communication between INTRALOG WMS SQL clients and servers. Precondition for exploitation: requires attacker to be located in the controlled network of the INTRALOG WMS deployment. .NET and Visual Studio Remote Code Execution Vulnerability Find more information about this vulnerability at <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30045>. Impact: Potential execution of arbitrary code on the INTRALOG WMS application servers. Precondition for exploitation: requires attacker to be located in the controlled network of the INTRALOG WMS deployment.

msrc_CVE-2024-30045 — .NET and Visual Studio Remote Code Execution Vulnerability

msrc_CVE-2024-30045

RHSA-2024:2842 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: stack buffer overrun in Double Parse dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop()

UBUNTU-CVE-2024-30045

Affected: Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8

.NET and Visual Studio Remote Code Execution Vulnerability

WID-SEC-W-2024-1115 — Microsoft Developer Tools: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio und Microsoft .NET Framework ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.