Most recent entries from all

ALSA-2024:7851 — Important: .NET 6.0 security update

Affected: AlmaLinux:8: aspnetcore-runtime-6.0, AlmaLinux:8: aspnetcore-targeting-pack-6.0, AlmaLinux:8: dotnet-apphost-pack-6.0, AlmaLinux:8: dotnet-hostfxr-6.0, AlmaLinux:8: dotnet-runtime-6.0, AlmaLinux:8: dotnet-sdk-6.0, AlmaLinux:8: dotnet-sdk-6.0-source-built-artifacts, AlmaLinux:8: dotnet-targeting-pack-6.0, AlmaLinux:8: dotnet-templates-6.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.135 and .NET Runtime 6.0.35.

Security Fix(es):

* dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-08707

BELL-CVE-2024-43485

Affected: Alpaquita:stream: dotnet6-runtime

BIT-dotnet-2024-43485 — .NET and Visual Studio Denial of Service Vulnerability

Affected: Bitnami: dotnet

.NET and Visual Studio Denial of Service Vulnerability

certfr-2024-avi-0855 — De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Elles permettent à un attaquant de provoquer une e…

certfr-2024-avi-0855

CLEANSTART-2025-SP12252 — .NET and Visual Studio Denial of Service Vulnerability

Affected: CleanStart: dotnet6-build, CleanStart: dotnet6-runtime, CleanStart: dotnet8-runtime

CVE-2024-43485 affects multiple packages. . See references for individual vulnerability details.

cnvd-2024-44521

EUVD-2026-355777

fkie_cve-2024-43485

.NET and Visual Studio Denial of Service Vulnerability

GHSA-8g4q-xg66-9fp4 — Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability

Affected: NuGet: System.Text.Json

# Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Text.Json 6.0.x and 8.0.x. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

In System.Text.Json 6.0.x and 8.0.x, applications which deserialize input to a model with an `[JsonExtensionData]` property can be vulnerable to an algorithmic complexity attack resulting in Denial of Service.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/329

## <a name="mitigation-factors"></a>Mitigation factors

JSON models which do not utilize the `[JsonExtensionData]` feature are not impacted by this vulnerability.

## <a name="affected-software"></a>Affected software

* Any .NET 8.0 application running on .NET 8.0.8 or earlier. * Any .NET 6.0 aplication running on .NET 6.0.33 or earlier. * Any application consuming one of the [vulnerable packages](affected-packages).

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

### <a name=".NET 8"></a>.NET 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Text.Json](https://www.nuget.org/packages/…

ICSA-25-135-02 — Siemens INTRALOG WMS

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability .NET Denial of Service Vulnerability .NET and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Remote Code Execution Vulnerability .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability .NET and Visual Studio Denial of Service Vulnerability .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Denial of Service Vulnerability

msrc_CVE-2024-43485 — .NET and Visual Studio Denial of Service Vulnerability

msrc_CVE-2024-43485

RHSA-2024:7851 — Red Hat Security Advisory: .NET 6.0 security update

dotnet: Multiple .NET components susceptible to hash flooding dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList dotnet: Denial of Service in System.Text.Json

RHSA-2024:8036 — Red Hat Security Advisory: .NET 6.0 security update

dotnet: Multiple .NET components susceptible to hash flooding dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList dotnet: Denial of Service in System.Text.Json

UBUNTU-CVE-2024-43485

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet8

.NET and Visual Studio Denial of Service Vulnerability

WID-SEC-W-2024-3124 — Microsoft Entwicklerwerkzeuge: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio 2015, Microsoft Visual Studio 2017, Microsoft Visual Studio Code, Microsoft .NET Framework, Microsoft Visual Studio 2019, Microsoft Visual Studio 2022 und Microsoft Visual C++ ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und einen Denial-of-Service-Zustand zu erzeugen.