This bug was fixed in the package dotnet10 -
10.0.113-10.0.13-0ubuntu1~24.04.1
---------------
dotnet10 (10.0.113-10.0.13-0ubuntu1~24.04.1) noble-security; urgency=medium
* New upstream release
* SECURITY UPDATE: remote code execution
- CVE-2026-102870: The Blazor WebAssembly debug proxy embeds
attacker-controlled ToString(), description, and class-name values into
generated C# without consistently escaping them. When a developer
evaluates an expression while debugging, the value can escape the
generated string literal and execute code on the developer's machine.
* SECURITY UPDATE: denial of service
- CVE-2026-58280: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: information disclosure
- CVE-2026-66822: SocketsHttpHandler can retain a Proxy-Authorization
header across an HTTP redirect and leak basic proxy credentials to the
destination server.
* SECURITY UPDATE: denial of service
- CVE-2026-69651: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: denial of service
- CVE-2026-70159: SignalR stateful reconnect clients can indefinitely block
broadcasts through MessageBuffer.ResendAsync backpressure and retain
associated resources.
* SECURITY UPDATE: information disclosure
- CVE-2026-70175: ASP.NET Core Identity password-reset and confirmation
flows can send mail to the unvalidated request address instead of the
user's stored canonical address.
* SECURITY UPDATE: security feature bypass
- CVE-2026-70179: ASP.NET Core Negotiate LDAP authentication can associate
an authenticated identity with an unintended LDAP principal when the LDAP
result is not verified against the Kerberos principal SID.
* SECURITY UPDATE: denial of service
- CVE-2026-70181: FileBufferingReadStream eagerly rents buffers during
multipart processing, allowing memory exhaustion and denial of service.
* SECURITY UPDATE: security feature bypass
- CVE-2026-70183: A stale asynchronous authorization result in Blazor
AuthorizeRouteView can be applied after navigation or an
authorization-state change, bypassing the current [Authorize] decision.
* SECURITY UPDATE: denial of service
- CVE-2026-70186: An unauthenticated remote attacker can send crafted
HTTP/3 reset or abort sequences that deadlock Kestrel connection
handling. Repeated requests can cause excessive blocked-thread creation
and exhaust server resources, resulting in denial of service. The
application must expose an HTTP/3 endpoint to the attacker.
* SECURITY UPDATE: security feature bypass
- CVE-2026-70188: Kestrel accepts newline characters in HTTP/2 request
trailers and values retrieved from the dynamic HPACK table instead of
treating them as malformed.
* SECURITY UPDATE: denial of service
- CVE-2026-70196: Incrementally arriving form data can cause FormPipeReader
to repeatedly rescan the full buffered body, resulting in quadratic CPU
consumption and denial of service.
* SECURITY UPDATE: denial of service
- CVE-2026-84008: SignedCms.CheckSignature can repeatedly reparse
attacker-controlled X.509 data, causing unauthenticated quadratic CPU
exhaustion.
* SECURITY UPDATE: information disclosure
- CVE-2026-88092: An aborted Kestrel HTTP/1 connection can reparse unread
request-body bytes as another request, creating a request-smuggling or
desynchronization path.
* SECURITY UPDATE: denial of service
- CVE-2026-92707: SignalR's MessagePack protocol can consume excessive
memory while deserializing deeply nested attacker-controlled arrays,
resulting in unauthenticated remote denial of service.
* SECURITY UPDATE: elevation of privilege
- CVE-2026-96225: Unix named-mutex and shared-memory paths can be
manipulated through insecure global directories, symlink races, and
unsafe permission changes, allowing local attackers to truncate or
overwrite files, widen directory permissions, or elevate privileges.
* SECURITY UPDATE: remote code execution
- CVE-2026-96230: The Blazor WebAssembly development-server debug page can
reflect unencoded exception text, allowing cross-origin script injection
through the unauthenticated /_framework/debug endpoint used by dotnet
watch.
* SECURITY UPDATE: elevation of privilege
- CVE-2026-96231: Unix named-mutex and shared-memory paths can be
manipulated through insecure global directories, symlink races, and
unsafe permission changes, allowing local attackers to truncate or
overwrite files, widen directory permissions, or elevate privileges.
* SECURITY UPDATE: denial of service
- CVE-2026-96233: DateTime Hebrew-number parsing can read outside expected
stack bounds and terminate the process.
* SECURITY UPDATE: denial of service
- CVE-2026-96236: ASP.NET Core request-localization fallback can add
attacker-supplied synthetic culture names to the runtime's global cache,
allowing unauthenticated requests to cause unbounded memory growth and
denial of service.
* SECURITY UPDATE: remote code execution
- CVE-2026-96237: SDK workload package downloads and integrity-repair paths
can bypass NuGet Package Source Mapping, allowing packages to be
reacquired from an unmapped attacker-controlled feed and potentially
enabling remote code execution.
* SECURITY UPDATE: security feature bypass
- CVE-2026-96238: dotnet new install can acquire a template package from a
feed that is not permitted by NuGet Package Source Mapping, bypassing the
configured feed trust boundary.
* SECURITY UPDATE: security feature bypass
- CVE-2026-96957: Signature verification for .NET file-based apps can fail
to enforce the expected trust decision.
* SECURITY UPDATE: denial of service
- CVE-2026-96958: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: denial of service
- CVE-2026-96959: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: denial of service
- CVE-2026-96960: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* d/t/regular-tests/debugging-via-dotnet-dump/test.sh: accept the DAC file
name without a path in the `runtimes` output, fixing an autopkgtest
regression caused by dotnet-dump no longer printing the full DAC path.
* d/t/regular-tests/lttng/test.sh: prefer babeltrace2 over babeltrace to
read traces, as lttng-tools >= 2.15 writes CTF 2 traces that babeltrace
1.x cannot read.
-- Nicolas Rincon <[email protected]> Thu, 08 Oct 2026
21:46:40 -0500
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167382
Title:
autopkgtest regression: debugging-sos-lldb-via-core and debugging-via-
dotnet-dump fail
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dotnet10/+bug/2167382/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
