Most recent entries from all

ALSA-2024:2842 — Important: .NET 8.0 security update

Affected: AlmaLinux:9: aspnetcore-runtime-8.0, AlmaLinux:9: aspnetcore-runtime-dbg-8.0, AlmaLinux:9: aspnetcore-targeting-pack-8.0, AlmaLinux:9: dotnet-apphost-pack-8.0, AlmaLinux:9: dotnet-host, AlmaLinux:9: dotnet-hostfxr-8.0, AlmaLinux:9: dotnet-runtime-8.0, AlmaLinux:9: dotnet-runtime-dbg-8.0, AlmaLinux:9: dotnet-sdk-8.0, AlmaLinux:9: dotnet-sdk-8.0-source-built-artifacts and 4 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.105 and .NET Runtime 8.0.5.

Security Fix(es):

* dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-03967

BIT-dotnet-2024-30046 — Visual Studio Denial of Service Vulnerability

Affected: Bitnami: dotnet

Visual Studio Denial of Service Vulnerability

certfr-2024-avi-0403 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2024-avi-0403

CLEANSTART-2025-RD49573 — Visual Studio Denial of Service Vulnerability

Affected: CleanStart: dotnet8-runtime

Security vulnerability affects the dotnet8-runtime package. Visual Studio Denial of Service Vulnerability

EUVD-2026-236826

fkie_cve-2024-30046

Visual Studio Denial of Service Vulnerability

GHSA-hhc7-x9w4-cw47 — Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability

Affected: NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-arm64, NuGet: Microsoft.AspNetCore.App.Runtime.osx-x64, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm, NuGet: Microsoft.AspNetCore.App.Runtime.win-arm64 and 2 more

# Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Vulnerability exist in Microsoft.AspNetCore.Server.Kestrel.Core.dll where a dead-lock can occur resulting in Denial of Service.

## Discussion

Discussion for this issue can be found at https://github.com/dotnet/aspnetcore/issues/55714

## <a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 7.0 application running on .NET 7.0.18 or earlier. * Any .NET 8.0 application running on .NET 8.0.4 or earlier.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### <a name="ASP.NET 7"></a>ASP.NET 7

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm) | <= 7.0.18 | 7.0.19 [Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNet…

gsd-2024-30046

msrc_CVE-2024-30046 — Visual Studio Denial of Service Vulnerability

msrc_CVE-2024-30046

RHSA-2024:2842 — Red Hat Security Advisory: .NET 8.0 security update

dotnet: stack buffer overrun in Double Parse dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop()

UBUNTU-CVE-2024-30046

Affected: Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8

Visual Studio Denial of Service Vulnerability

WID-SEC-W-2024-1115 — Microsoft Developer Tools: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio und Microsoft .NET Framework ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.