USN-6161-2
dotnet6, dotnet7 regression
USN-6161-1 fixed vulnerabilities in .NET. The update introduced a regression with regards to how the runtime imported X.509 certificates. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that .NET did not properly enforce certain restrictions when deserializing a DataSet or DataTable from XML. An attacker could possibly use this issue to elevate their privileges. (CVE-2023-24936)
Kevin Jones discovered that .NET did not properly handle the AIA fetching process for X.509 client certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-29331)
Kalle Niemitalo discovered that the .NET package manager, NuGet, was susceptible to a potential race condition. An attacker could possibly use this issue to perform remote code execution. (CVE-2023-29337)
Tom Deseyn discovered that .NET did not properly process certain arguments when extracting the contents of a tar file. An attacker could possibly use this issue to elevate their privileges. This issue only affected the dotnet7 package. (CVE-2023-32032)
It was discovered that .NET did not properly handle memory in certain circumstances. An attacker could possibly use this issue to cause a denial of service or perform remote code execution. (CVE-2023-33128)
What each source reports
OSV No score
dotnet6, dotnet7 regression
USN-6161-1 fixed vulnerabilities in .NET. The update introduced a regression with regards to how the runtime imported X.509 certificates. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that .NET did not properly enforce certain restrictions when deserializing a DataSet or DataTable from XML. An attacker could possibly use this issue to elevate their privileges. (CVE-2023-24936)
Kevin Jones discovered that .NET did not properly handle the AIA fetching process for X.509 client certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-29331)
Kalle Niemitalo discovered that the .NET package manager, NuGet, was susceptible to a potential race condition. An attacker could possibly use this issue to perform remote code execution. (CVE-2023-29337)
Tom Deseyn discovered that .NET did not properly process certain arguments when extracting the contents of a tar file. An attacker could possibly use this issue to elevate their privileges. This issue only affected the dotnet7 package. (CVE-2023-32032)
It was discovered that .NET did not properly handle memory in certain circumstances. An attacker could possibly use this issue to cause a denial of service or perform remote code execution. (CVE-2023-33128)
- Record
USN-6161-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dotnet6Ubuntu:22.04:LTS |
before 6.0.119-0ubuntu1~22.04.1, plus listed versions 6.0.108-0ubuntu1~22.04.16.0.109-0ubuntu1~22.04.16.0.110-0ubuntu1~22.04.16.0.111-0ubuntu1~22.04.16.0.113-0ubuntu1~22.04.16.0.116-0ubuntu1~22.04.16.0.118-0ubuntu1~22.04.1 |
6.0.119-0ubuntu1~22.04.1 |
dotnet7Ubuntu:22.04:LTS |
before 7.0.108-0ubuntu1~22.04.1, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.1 |
7.0.108-0ubuntu1~22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6161-2 is a vulnerability with no CVSS score yet in dotnet6, published June 23, 2023. No source lists public exploit code. Fixed in dotnet6 6.0.119-0ubuntu1~22.04.1.