Ubuntu 25.04: USN-7563-1 moderate: .NET network code execution

ubuntu

June 11, 2025

.NET could be made to crash or run programs if it received specially crafted network traffic.

Summary

.NET could be made to crash or run programs if it received specially

crafted network traffic.

Software Description:

- dotnet8: .NET CLI tools and runtime

- dotnet9: .NET CLI tools and runtime

Details:

It was discovered that .NET did not properly validate search path in

Microsoft.NETCore.App.Runtime. An attacker could possibly use this issue

to execute arbitrary code.

Topics Covered

security advisory Ubuntu update instructions execution network threat dotnet

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  aspnetcore-runtime-8.0          8.0.17-0ubuntu1~25.04.1
  aspnetcore-runtime-9.0          9.0.6-0ubuntu1~25.04.1
  dotnet-host-8.0                 8.0.17-0ubuntu1~25.04.1
  dotnet-host-9.0                 9.0.6-0ubuntu1~25.04.1
  dotnet-hostfxr-8.0              8.0.17-0ubuntu1~25.04.1
  dotnet-hostfxr-9.0              9.0.6-0ubuntu1~25.04.1
  dotnet-runtime-8.0              8.0.17-0ubuntu1~25.04.1
  dotnet-runtime-9.0              9.0.6-0ubuntu1~25.04.1
  dotnet-sdk-8.0                  8.0.117-0ubuntu1~25.04.1
  dotnet-sdk-9.0                  9.0.107-0ubuntu1~25.04.1
  dotnet8                         8.0.117-8.0.17-0ubuntu1~25.04.1
  dotnet9                         9.0.107-9.0.6-0ubuntu1~25.04.1

Ubuntu 24.10
  aspnetcore-runtime-8.0          8.0.17-0ubuntu1~24.10.1
  aspnetcore-runtime-9.0          9.0.6-0ubuntu1~24.10.1
  dotnet-host-8.0                 8.0.17-0ubuntu1~24.10.1
  dotnet-host-9.0                 9.0.6-0ubuntu1~24.10.1
  dotnet-hostfxr-8.0              8.0.17-0ubuntu1~24.10.1
  dotnet-hostfxr-9.0              9.0.6-0ubuntu1~24.10.1
  dotnet-runtime-8.0              8.0.17-0ubuntu1~24.10.1
  dotnet-runtime-9.0              9.0.6-0ubuntu1~24.10.1
  dotnet-sdk-8.0                  8.0.117-0ubuntu1~24.10.1
  dotnet-sdk-9.0                  9.0.107-0ubuntu1~24.10.1
  dotnet8                         8.0.117-8.0.17-0ubuntu1~24.10.1
  dotnet9                         9.0.107-9.0.6-0ubuntu1~24.10.1

Ubuntu 24.04 LTS
  aspnetcore-runtime-8.0          8.0.17-0ubuntu1~24.04.1
  dotnet-host-8.0                 8.0.17-0ubuntu1~24.04.1
  dotnet-hostfxr-8.0              8.0.17-0ubuntu1~24.04.1
  dotnet-runtime-8.0              8.0.17-0ubuntu1~24.04.1
  dotnet-sdk-8.0                  8.0.117-0ubuntu1~24.04.1
  dotnet8                         8.0.117-8.0.17-0ubuntu1~24.04.1

Ubuntu 22.04 LTS
  aspnetcore-runtime-8.0          8.0.17-0ubuntu1~22.04.1
  dotnet-host-8.0                 8.0.17-0ubuntu1~22.04.1
  dotnet-hostfxr-8.0              8.0.17-0ubuntu1~22.04.1
  dotnet-runtime-8.0              8.0.17-0ubuntu1~22.04.1
  dotnet-sdk-8.0                  8.0.117-0ubuntu1~22.04.1
  dotnet8                         8.0.117-8.0.17-0ubuntu1~22.04.1

In general, a standard system update will make all the necessary changes.