==========================================================================
Ubuntu Security Notice USN-6889-1
July 09, 2024

dotnet6, dotnet8 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in dotnet6, dotnet8.

Software Description:
- dotnet8: .NET CLI tools and runtime
- dotnet6: .NET CLI tools and runtime

Details:

It was discovered that .NET did not properly handle object
deserialization. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-30105)

Radek Zikmund discovered that .NET did not properly manage memory. An
attacker could use this issue to cause a denial of service or possibly
execute arbitrary code. (CVE-2024-35264)

It was discovered that .NET did not properly parse X.509 Content and
ObjectIdentifiers. An attacker could possibly use this issue to cause
a denial of service. (CVE-2024-38095)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   aspnetcore-runtime-8.0          8.0.7-0ubuntu1~24.04.1
   dotnet-host-8.0                 8.0.7-0ubuntu1~24.04.1
   dotnet-hostfxr-8.0              8.0.7-0ubuntu1~24.04.1
   dotnet-runtime-8.0              8.0.7-0ubuntu1~24.04.1
   dotnet-sdk-8.0                  8.0.107-0ubuntu1~24.04.1
   dotnet8                         8.0.107-8.0.7-0ubuntu1~24.04.1

Ubuntu 23.10
   aspnetcore-runtime-6.0          6.0.132-0ubuntu1~23.10.1
   aspnetcore-runtime-8.0          8.0.7-0ubuntu1~23.10.1
   dotnet-host                     6.0.132-0ubuntu1~23.10.1
   dotnet-host-8.0                 8.0.7-0ubuntu1~23.10.1
   dotnet-hostfxr-6.0              6.0.132-0ubuntu1~23.10.1
   dotnet-hostfxr-8.0              8.0.7-0ubuntu1~23.10.1
   dotnet-runtime-6.0              6.0.132-0ubuntu1~23.10.1
   dotnet-runtime-8.0              8.0.7-0ubuntu1~23.10.1
   dotnet-sdk-6.0                  6.0.132-0ubuntu1~23.10.1
   dotnet-sdk-8.0                  8.0.107-0ubuntu1~23.10.1
   dotnet6                         6.0.132-0ubuntu1~23.10.1
   dotnet8                         8.0.107-8.0.7-0ubuntu1~23.10.1

Ubuntu 22.04 LTS
   aspnetcore-runtime-6.0          6.0.132-0ubuntu1~22.04.1
   aspnetcore-runtime-8.0          8.0.7-0ubuntu1~22.04.1
   dotnet-host                     6.0.132-0ubuntu1~22.04.1
   dotnet-host-8.0                 8.0.7-0ubuntu1~22.04.1
   dotnet-hostfxr-6.0              6.0.132-0ubuntu1~22.04.1
   dotnet-hostfxr-8.0              8.0.7-0ubuntu1~22.04.1
   dotnet-runtime-6.0              6.0.132-0ubuntu1~22.04.1
   dotnet-runtime-8.0              8.0.7-0ubuntu1~22.04.1
   dotnet-sdk-6.0                  6.0.132-0ubuntu1~22.04.1
   dotnet-sdk-8.0                  8.0.107-0ubuntu1~22.04.1
   dotnet6                         6.0.132-0ubuntu1~22.04.1
   dotnet8                         8.0.107-8.0.7-0ubuntu1~22.04.1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6889-1
   CVE-2024-30105, CVE-2024-35264, CVE-2024-38095

Package Information:
https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~24.04.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.132-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.132-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~22.04.1

Ubuntu 6889-1: .NET Security Advisory Updates

July 10, 2024
Several security issues were fixed in dotnet6, dotnet8.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 - Ubuntu 22.04 LTS Summary: Several security issues were fixed in dotnet6, dotnet8. Software Description: - dotnet8: .NET CLI tools and runtime - dotnet6: .NET CLI tools and runtime Details: It was discovered that .NET did not properly handle object deserialization. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-30105) Radek Zikmund discovered that .NET did not properly manage memory. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-35264) It was discovered that .NET did not properly parse X.509 Content and ObjectIdentifiers. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-38095)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS   aspnetcore-runtime-8.0          8.0.7-0ubuntu1~24.04.1   dotnet-host-8.0                 8.0.7-0ubuntu1~24.04.1   dotnet-hostfxr-8.0              8.0.7-0ubuntu1~24.04.1   dotnet-runtime-8.0              8.0.7-0ubuntu1~24.04.1   dotnet-sdk-8.0                  8.0.107-0ubuntu1~24.04.1   dotnet8                         8.0.107-8.0.7-0ubuntu1~24.04.1 Ubuntu 23.10   aspnetcore-runtime-6.0          6.0.132-0ubuntu1~23.10.1   aspnetcore-runtime-8.0          8.0.7-0ubuntu1~23.10.1   dotnet-host                     6.0.132-0ubuntu1~23.10.1   dotnet-host-8.0                 8.0.7-0ubuntu1~23.10.1   dotnet-hostfxr-6.0              6.0.132-0ubuntu1~23.10.1   dotnet-hostfxr-8.0              8.0.7-0ubuntu1~23.10.1   dotnet-runtime-6.0              6.0.132-0ubuntu1~23.10.1   dotnet-runtime-8.0              8.0.7-0ubuntu1~23.10.1   dotnet-sdk-6.0                  6.0.132-0ubuntu1~23.10.1   dotnet-sdk-8.0                  8.0.107-0ubuntu1~23.10.1   dotnet6                         6.0.132-0ubuntu1~23.10.1   dotnet8                         8.0.107-8.0.7-0ubuntu1~23.10.1 Ubuntu 22.04 LTS   aspnetcore-runtime-6.0          6.0.132-0ubuntu1~22.04.1   aspnetcore-runtime-8.0          8.0.7-0ubuntu1~22.04.1   dotnet-host                     6.0.132-0ubuntu1~22.04.1   dotnet-host-8.0                 8.0.7-0ubuntu1~22.04.1   dotnet-hostfxr-6.0              6.0.132-0ubuntu1~22.04.1   dotnet-hostfxr-8.0              8.0.7-0ubuntu1~22.04.1   dotnet-runtime-6.0              6.0.132-0ubuntu1~22.04.1   dotnet-runtime-8.0              8.0.7-0ubuntu1~22.04.1   dotnet-sdk-6.0                  6.0.132-0ubuntu1~22.04.1   dotnet-sdk-8.0                  8.0.107-0ubuntu1~22.04.1   dotnet6                         6.0.132-0ubuntu1~22.04.1   dotnet8                         8.0.107-8.0.7-0ubuntu1~22.04.1 In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6889-1

  CVE-2024-30105, CVE-2024-35264, CVE-2024-38095

Severity
Ubuntu Security Notice USN-6889-1

Package Information

https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~24.04.1 https://launchpad.net/ubuntu/+source/dotnet6/6.0.132-0ubuntu1~23.10.1 https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~23.10.1 https://launchpad.net/ubuntu/+source/dotnet6/6.0.132-0ubuntu1~22.04.1 https://launchpad.net/ubuntu/+source/dotnet8/8.0.107-8.0.7-0ubuntu1~22.04.1

Related News

Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven
Microsoft Update Mayhem: Rescuing Linux Dual-Boot Systems from Secure Boot Woes
2 - 4 min read
Microsoft's recent patch, intended to strengthen Secure Boot defenses, has resulted in an unexpected setback for Linux-Windows dual-boot setups

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved