Description
.NET Framework Remote Code Execution Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 – < 17.2.11 | 17.2.11 |
| Microsoft | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | 16.11.0 – < 16.11.22 | 16.11.22 |
| Microsoft | Microsoft Visual Studio 2022 version 17.0 | 17.0.0 – < 17.0.17 | 17.0.17 |
| Microsoft | Microsoft Visual Studio 2022 version 17.4 | 17.4.0 – < 17.4.3 | 17.4.3 |
| Microsoft | .NET 6.0 | 6.0.0 – < 6.0.12 | 6.0.12 |
| Microsoft | .NET Core 3.1 | 3.1 – < 3.1.32 | 3.1.32 |
| Microsoft | .NET 7.0 | 7.0.0 – < 7.0.1 | 7.0.1 |
| Microsoft | PowerShell 7.2 | 7.2.0 – < 7.2.9 | 7.2.9 |
| Microsoft | PowerShell 7.3 | 7.3.0 – < 7.3.2 | 7.3.2 |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 – < 04590.02 | 04590.02 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 – < 04590.02 | 04590.02 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 – < 04010.02 | 04010.02 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | 4.8.1 – < 09115.01 | 09115.01 |
| Microsoft | Microsoft .NET Framework 2.0 Service Pack 2 | 2.0.0 – < 30729.8953 | 30729.8953 |
| Microsoft | Microsoft .NET Framework 3.0 Service Pack 2 | 3.0.0 – < 30729.8953 | 30729.8953 |
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 – < 30729.8953 | 30729.8953 |
| Microsoft | Microsoft .NET Framework 3.5.1 | 3.5.0 – < 30729.8953 | 30729.8953 |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | 4.7.0 – < 04010.02 | 04010.02 |
| Microsoft | Microsoft .NET Framework 4.6.2 | 4.7.0 – < 04010.02 | 04010.02 |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6/4.6.2 | 10.0.0 – < 10.0.10240.19624 | 10.0.10240.19624 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.20 | dotnet6-build | 6.0.112-r0 | — |
| Alpine v3.20 | dotnet6-runtime | 6.0.12-r0 | — |
| Alpine v3.19 | dotnet6-build | 6.0.112-r0 | — |
| Alpine v3.19 | dotnet6-runtime | 6.0.12-r0 | — |
| Alpine v3.18 | dotnet6-build | 6.0.112-r0 | — |
| Alpine v3.18 | dotnet6-runtime | 6.0.12-r0 | — |
| Alpine v3.17 | dotnet6-build | 6.0.112-r0 | — |
| Alpine v3.17 | dotnet6-runtime | 6.0.12-r0 | — |
| Alpine v3.17 | dotnet7-build | 7.0.101-r0 | — |
| Alpine v3.17 | dotnet7-runtime | 7.0.1-r0 | — |
| Alpine v3.16 | dotnet6-build | 6.0.112-r0 | — |
| Alpine v3.16 | dotnet6-runtime | 6.0.12-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 6.0.0, < 6.0.12 | 6.0.12 | GHSA-2c7v-qcjp-4mg2 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-arm64 | >= 7.0.0, < 7.0.1 | 7.0.1 | GHSA-2c7v-qcjp-4mg2 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 3.1.0, < 3.1.32 | 3.1.32 | GHSA-2c7v-qcjp-4mg2 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 6.0.0, < 6.0.12 | 6.0.12 | GHSA-2c7v-qcjp-4mg2 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x64 | >= 7.0.0, < 7.0.1 | 7.0.1 | GHSA-2c7v-qcjp-4mg2 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 3.1.0, < 3.1.32 | 3.1.32 | GHSA-2c7v-qcjp-4mg2 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 6.0.0, < 6.0.12 | 6.0.12 | GHSA-2c7v-qcjp-4mg2 |
| NuGet | Microsoft.WindowsDesktop.App.Runtime.win-x86 | >= 7.0.0, < 7.0.1 | 7.0.1 | GHSA-2c7v-qcjp-4mg2 |
Advisories 2
- MSRC-CVE-2022-41089 .NET Framework Remote Code Execution Vulnerability Microsoft Security Response Center · Jun 30, 2023
- WID-SEC-2022-2307 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 13, 2022
References
- .NET Framework Remote Code Execution Vulnerability vendor-advisory