Summary
It was discovered that .NET did not properly handle the creation of temporary
build time directories. An attacker could possibly use this issue to cause a
denial of service. (CVE-2025-55247)
It was discovered that .NET did not properly establish TLS sessions for
SMTP server connections. An attacker could use this issue to cause .NET
to use unencrypted connections. This issue only affects .NET versions 8.0
and 9.0. (CVE-2025-55248)
It was discovered that .NET inconsistently interpreted certain http
requests. An attacker could possibly use this to bypass a security feature
over a network. (CVE-2025-55315)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet8 | 8.0.121-8.0.21-0ubuntu1~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet8 | 8.0.121-8.0.21-0ubuntu1~24.04.1 |
| Ubuntu · 25.10 | dotnet10 | 10.0.100-10.0.0~rc2-0ubuntu1~25.10.2 |
| Ubuntu · 25.10 | dotnet8 | 8.0.121-8.0.21-0ubuntu1~25.10.1 |
| Ubuntu · 25.10 | dotnet9 | 9.0.111-9.0.10-0ubuntu1~25.10.1 |
Vulnerabilities 3
-
Critical 9.9
ASP.NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
Medium 4.8
.NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.