WID-SEC-2023-1446 — Microsoft Developer Tools: Mehrere Schwachstellen

Summary

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft .NET Framework, Microsoft Azure DevOps Server, Microsoft NuGet, Microsoft Visual Studio und Microsoft Visual Studio Code ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen, seine Rechte zu erweitern und Daten zu manipulieren.

Product

Microsoft .NET Framework ist eine Komponente des Microsoft Windows-Betriebssystems, das die Erstellung und Ausführung von Softwareanwendungen und Webdiensten ermöglicht. Es beinhaltet sowohl eine Laufzeitumgebung als auch ein Framework von Klassenbibliotheken (APIs), u. a. für die Programmiersprache ASP (ASP.NET), den Datenzugriff (ADO.NET), intelligente Clientanwendungen (Windows Forms) und weitere.
Microsoft Azure DevOps Server ist eine Plattform für kollaborative Softwareprojekte.
NuGet ist ein Programm für die Verteilung von Software.
Microsoft Visual Studio ist eine integrierte Entwicklungsumgebung für Hochsprachen.
Visual Studio Code ist ein Quelltext-Editor von Microsoft.

Vulnerabilities 25

High 7.8

CVE-2023-24895

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-24897

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-27909

An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through mal…

Apr 17, 2023
High 7.8

CVE-2023-27910

A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autod…

Apr 17, 2023
High 7.8

CVE-2023-27911

A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autode…

Apr 17, 2023
High 7.8

CVE-2023-29326

.NET Framework Remote Code Execution Vulnerability

.NET Framework Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.8.1

Jun 14, 2023
High 7.6

CVE-2023-29011

Git for Windows's config file of `connect.exe` is susceptible to malicious placing

Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SSH servers via proxies when certain ports are blocked for outgoing connections. The location of `conn…

git-for-windows git

Apr 25, 2023
High 7.5

CVE-2023-24936

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-25652 EPSS 52%

"git apply --reject" partially-controlled arbitrary file write

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with…

git git git git Debian Ubuntu Alpine Wolfi

Apr 25, 2023
High 7.5

CVE-2023-29331

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-32030

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2

Jun 14, 2023
High 7.5

CVE-2023-33141

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Microsoft YARP 1.0 YARP 2.0 Yarp.ReverseProxy NuGet

Jun 23, 2023
High 7.3

CVE-2023-29012

Git CMD erroneously executes `doskey.exe` in the current directory, if it exists

Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Uncontrolles Search Path Element vulnerability. Maliciously-placed `doskey.exe` would be executed silen…

git-for-windows git

Apr 25, 2023
High 7.3

CVE-2023-33126

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Jun 13, 2023
High 7.3

CVE-2023-33128

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Jun 13, 2023
High 7.3

CVE-2023-33135

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine

Jun 13, 2023
High 7.1

CVE-2023-21565

Azure DevOps Server Spoofing Vulnerability

Azure DevOps Server Spoofing Vulnerability

Microsoft Azure DevOps Server 2020.1.2 Azure DevOps Server 2022 Azure DevOps Server 2022.0.1

Jun 13, 2023
High 7.1

CVE-2023-29337

NuGet Client Remote Code Execution Vulnerability

NuGet Client Remote Code Execution Vulnerability

Microsoft NuGet 6.0.4 NuGet 5.11.4 NuGet 6.4.1 Debian Ubuntu Alpine NuGet

Jun 14, 2023
High 7.0

CVE-2023-29007 Public exploit

Arbitrary configuration injection via `git submodule deinit`

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit…

git git git git Debian Ubuntu Alpine Wolfi

Apr 25, 2023
Medium 6.6

CVE-2023-33144

Visual Studio Code Spoofing Vulnerability

Visual Studio Code Spoofing Vulnerability

Microsoft Visual Studio Code

Jun 13, 2023
Medium 6.5

CVE-2023-32032

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine

Jun 13, 2023
Medium 5.5

CVE-2023-21569

Azure DevOps Server Spoofing Vulnerability

Azure DevOps Server Spoofing Vulnerability

Microsoft Azure DevOps Server 2020.1.2 Azure DevOps Server 2022 Azure DevOps Server 2022.0.1

Jun 13, 2023
Medium 5.5

CVE-2023-29353

Sysinternals Process Monitor for Windows Denial of Service Vulnerability

Sysinternals Process Monitor for Windows Denial of Service Vulnerability

Microsoft Windows Sysinternals Process Monitor Sysinternals Suite Windows

Jun 13, 2023
Medium 5.5

CVE-2023-33139

Visual Studio Information Disclosure Vulnerability

Visual Studio Information Disclosure Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)

Jun 13, 2023
Low 3.3

CVE-2023-25815

Git looks for localized messages in the wrong place

In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…

git-for-windows git git git Debian Ubuntu Alpine

Apr 25, 2023

Revision history

2023-09-25 #7
Neue Updates von HITACHI aufgenommen
2023-08-02 #6
Neue Updates von Red Hat aufgenommen
2023-06-25 #5
Neue Updates von Ubuntu aufgenommen
2023-06-18 #4
Neue Updates von Oracle Linux aufgenommen
2023-06-15 #3
Neue Updates von Oracle Linux aufgenommen
2023-06-14 #2
Neue Updates von Red Hat aufgenommen
2023-06-13 #1
Initiale Fassung

References

Hitachi Vulnerability Information HITACHI-SEC-2023-306 vom 2023-09-26
https://www.hitachi.com/products/it/storage-solutions/sec_info/2023/06.html
Red Hat Security Advisory RHSA-2023:4449 vom 2023-08-03
https://access.redhat.com/errata/RHSA-2023:4449
Red Hat Security Advisory RHSA-2023:4448 vom 2023-08-03
https://access.redhat.com/errata/RHSA-2023:4448
Ubuntu Security Notice USN-6161-2 vom 2023-06-23
https://ubuntu.com/security/notices/USN-6161-2
Oracle Linux Security Advisory ELSA-2023-3592 vom 2023-06-17
https://linux.oracle.com/errata/ELSA-2023-3592.html
Oracle Linux Security Advisory ELSA-2023-3593 vom 2023-06-17
https://linux.oracle.com/errata/ELSA-2023-3593.html
Oracle Linux Security Advisory ELSA-2023-3582 vom 2023-06-16
https://linux.oracle.com/errata/ELSA-2023-3582.html
Oracle Linux Security Advisory ELSA-2023-3581 vom 2023-06-15
http://linux.oracle.com/errata/ELSA-2023-3581.html
Red Hat Security Advisory RHSA-2023:3593 vom 2023-06-14
https://access.redhat.com/errata/RHSA-2023:3593
Red Hat Security Advisory RHSA-2023:3581 vom 2023-06-14
https://access.redhat.com/errata/RHSA-2023:3581
Red Hat Security Advisory RHSA-2023:3580 vom 2023-06-14
https://access.redhat.com/errata/RHSA-2023:3580
Red Hat Security Advisory RHSA-2023:3582 vom 2023-06-14
https://access.redhat.com/errata/RHSA-2023:3582
Red Hat Security Advisory RHSA-2023:3592 vom 2023-06-14
https://access.redhat.com/errata/RHSA-2023:3592
Ubuntu Security Notice USN-6161-1 vom 2023-06-13
https://ubuntu.com/security/notices/USN-6161-1
Microsoft Leitfaden für Sicherheitsupdates vom 2023-06-13
https://msrc.microsoft.com/update-guide

Microsoft Developer Tools: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 25

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through mal…

A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autod…

A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autode…

.NET Framework Remote Code Execution Vulnerability

Git for Windows's config file of `connect.exe` is susceptible to malicious placing

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

"git apply --reject" partially-controlled arbitrary file write

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Git CMD erroneously executes `doskey.exe` in the current directory, if it exists

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Azure DevOps Server Spoofing Vulnerability

NuGet Client Remote Code Execution Vulnerability

Arbitrary configuration injection via `git submodule deinit`

Visual Studio Code Spoofing Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Azure DevOps Server Spoofing Vulnerability

Sysinternals Process Monitor for Windows Denial of Service Vulnerability

Visual Studio Information Disclosure Vulnerability

Git looks for localized messages in the wrong place

Revision history

References