Skip to content
OpenAdvisories
High USN-7210-1 4 CVEs

dotnet8, dotnet9 vulnerabilities

Published Jan 16, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that .NET did not properly handle input provided to its
Convert.TryToHexString method. An attacker could possibly use this issue
to execute arbitrary code. (CVE-2025-21171)

It was discovered that .NET did not properly handle an integer overflow
when processing certain specially crafted files. An attacker could
possibly use this issue to execute arbitrary code. (CVE-2025-21172)

Daniel Plaisted and Noah Gilson discovered that .NET insecurely handled
temporary file usage which could result in malicious package dependency
injection. An attacker could possibly use this issue to elevate privileges.
(CVE-2025-21173)

It was discovered that .NET did not properly perform input data validation
when processing certain specially crafted files. An attacker could
possibly use this issue to execute arbitrary code. (CVE-2025-21176)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS dotnet8 8.0.112-8.0.12-0ubuntu1~22.04.1
Ubuntu · 24.04 LTS 24.04:LTS dotnet8 8.0.112-8.0.12-0ubuntu1~24.04.1

Vulnerabilities 4

References

  • report
    https://ubuntu.com/security/CVE-2025-21171
  • report
    https://ubuntu.com/security/CVE-2025-21172
  • report
    https://ubuntu.com/security/CVE-2025-21173
  • report
    https://ubuntu.com/security/CVE-2025-21176