Summary
It was discovered that the NrbfDecoder component in .NET did not properly
handle an instance of a type confusion vulnerability. An authenticated
attacker could possibly use this issue to gain the privileges of another
user and execute arbitrary code. (CVE-2024-43498)
It was discovered that the NrbfDecoder component in .NET did not properly
perform input validation. An unauthenticated remote attacker could possibly
use this issue to cause a denial of service. (CVE-2024-43499)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.10 | dotnet9 | 9.0.100-9.0.0-0ubuntu1~24.10.1 |