Microsoft Developer Tools: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 12

• High 8.8
  CVE-2023-33136

  Azure DevOps Server Remote Code Execution Vulnerability

  Azure DevOps Server Remote Code Execution Vulnerability

  Microsoft Azure DevOps Server Azure DevOps Server 2020.1.2 Azure DevOps Server 2019.0.1
  Sep 12, 2023
• High 7.8
  CVE-2023-36742

  Visual Studio Code Remote Code Execution Vulnerability

  Visual Studio Code Remote Code Execution Vulnerability

  Microsoft Visual Studio Code
  Sep 12, 2023
• High 7.8
  CVE-2023-36758

  Visual Studio Elevation of Privilege Vulnerability

  Visual Studio Elevation of Privilege Vulnerability

  Microsoft Microsoft Visual Studio 2022 version 17.7
  Sep 12, 2023
• High 7.8
  CVE-2023-36788

  .NET Framework Remote Code Execution Vulnerability

  .NET Framework Remote Code Execution Vulnerability

  Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.8.1
  Sep 12, 2023
• High 7.8
  CVE-2023-36792

  Visual Studio Remote Code Execution Vulnerability

  Visual Studio Remote Code Execution Vulnerability

  Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet
  Sep 12, 2023
• High 7.8
  CVE-2023-36793

  Visual Studio Remote Code Execution Vulnerability

  Visual Studio Remote Code Execution Vulnerability

  Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet
  Sep 12, 2023
• High 7.8
  CVE-2023-36794

  Visual Studio Remote Code Execution Vulnerability

  Visual Studio Remote Code Execution Vulnerability

  Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet
  Sep 12, 2023
• High 7.8
  CVE-2023-36796

  Visual Studio Remote Code Execution Vulnerability

  Visual Studio Remote Code Execution Vulnerability

  Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet
  Sep 12, 2023
• High 7.0
  CVE-2023-38155

  Azure DevOps Server Remote Code Execution Vulnerability

  Azure DevOps Server Remote Code Execution Vulnerability

  Microsoft Azure DevOps Server Azure DevOps Server 2020.1.2 Azure DevOps Server 2022.0.1
  Sep 12, 2023
• Medium 6.7
  CVE-2023-36759

  Visual Studio Elevation of Privilege Vulnerability

  Visual Studio Elevation of Privilege Vulnerability

  Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.4
  Sep 12, 2023
• Medium 6.5
  CVE-2023-36799

  .NET Core and Visual Studio Denial of Service Vulnerability

  .NET Core and Visual Studio Denial of Service Vulnerability

  Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet
  Sep 12, 2023
• Medium 6.1
  CVE-2023-39956

  Electron: Out-of-package code execution when launched with arbitrary cwd

  Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following condition…

  electron electron electron npm
  Sep 6, 2023

Revision history

1. 2023-11-21 #7

   PoC aufgenommen

2. 2023-11-06 #6

   Neue Updates von Oracle Linux aufgenommen

3. 2023-11-02 #5

   Neue Updates von Oracle Linux und Red Hat aufgenommen

4. 2023-10-24 #4

   Neue Updates von Ubuntu aufgenommen

5. 2023-09-14 #3

   Neue Updates von Oracle Linux aufgenommen

6. 2023-09-13 #2

   Neue Updates von Red Hat aufgenommen

7. 2023-09-12 #1

   Initiale Fassung

References

• Oracle Linux Security Advisory ELSA-2023-6245 vom 2023-11-06
  http://linux.oracle.com/errata/ELSA-2023-6245.html
• Oracle Linux Security Advisory ELSA-2023-6242 vom 2023-11-03
  https://linux.oracle.com/errata/ELSA-2023-6242.html
• Red Hat Security Advisory RHSA-2023:6246 vom 2023-11-02
  https://access.redhat.com/errata/RHSA-2023:6246
• Oracle Linux Security Advisory ELSA-2023-6247 vom 2023-11-02
  https://linux.oracle.com/errata/ELSA-2023-6247.html
• Oracle Linux Security Advisory ELSA-2023-6246 vom 2023-11-03
  https://linux.oracle.com/errata/ELSA-2023-6246.html
• Ubuntu Security Notice USN-6362-2 vom 2023-10-25
  https://www.cybersecurity-help.cz/vdb/SB2023102524
• Ubuntu Security Notice USN-6438-2 vom 2023-10-25
  https://ubuntu.com/security/notices/USN-6438-2
• Oracle Linux Security Advisory ELSA-2023-5143 vom 2023-09-14
  https://linux.oracle.com/errata/ELSA-2023-5143.html
• Oracle Linux Security Advisory ELSA-2023-5144 vom 2023-09-14
  https://linux.oracle.com/errata/ELSA-2023-5144.html
• Oracle Linux Security Advisory ELSA-2023-5145 vom 2023-09-14
  https://linux.oracle.com/errata/ELSA-2023-5145.html
• Oracle Linux Security Advisory ELSA-2023-5146 vom 2023-09-14
  http://linux.oracle.com/errata/ELSA-2023-5146.html
• PoC Exploit vom 2023-11-06
  https://securityonline.info/poc-exploit-published-for-visual-studio-code-rce-vulnerability-cve-2023-36742/
• Oracle Linux Security Advisory ELSA-2023-5145 vom 2023-09-14
  http://linux.oracle.com/errata/ELSA-2023-5145.html
• Red Hat Security Advisory RHSA-2023:5146 vom 2023-09-13
  https://access.redhat.com/errata/RHSA-2023:5146
• Red Hat Security Advisory RHSA-2023:5145 vom 2023-09-13
  https://access.redhat.com/errata/RHSA-2023:5145
• Red Hat Security Advisory RHSA-2023:5142 vom 2023-09-13
  https://access.redhat.com/errata/RHSA-2023:5142
• Red Hat Security Advisory RHSA-2023:5143 vom 2023-09-13
  https://access.redhat.com/errata/RHSA-2023:5143
• Red Hat Security Advisory RHSA-2023:5144 vom 2023-09-13
  https://access.redhat.com/errata/RHSA-2023:5144
• Ubuntu Security Notice USN-6362-1 vom 2023-09-12
  https://ubuntu.com/security/notices/USN-6362-1
• Microsoft Leitfaden für Sicherheitsupdates vom 2023-09-12
  https://msrc.microsoft.com/update-guide