|
dotnet11 (11.0.100-11.0.0~rc2-0ubuntu1~26.10.1) stonking-security; urgency=medium
* New upstream release
* SECURITY UPDATE: remote code execution
- CVE-2026-102870: The Blazor WebAssembly debug proxy embeds
attacker-controlled ToString(), description, and class-name values into
generated C# without consistently escaping them. When a developer
evaluates an expression while debugging, the value can escape the
generated string literal and execute code on the developer's machine.
* SECURITY UPDATE: denial of service
- CVE-2026-58280: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: information disclosure
- CVE-2026-66822: SocketsHttpHandler can retain a Proxy-Authorization
header across an HTTP redirect and leak basic proxy credentials to the
destination server.
* SECURITY UPDATE: denial of service
- CVE-2026-69651: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: denial of service
- CVE-2026-70159: SignalR stateful reconnect clients can indefinitely block
broadcasts through MessageBuffer.ResendAsync backpressure and retain
associated resources.
* SECURITY UPDATE: security feature bypass
- CVE-2026-70183: A stale asynchronous authorization result in Blazor
AuthorizeRouteView can be applied after navigation or an
authorization-state change, bypassing the current [Authorize] decision.
* SECURITY UPDATE: security feature bypass
- CVE-2026-70188: Kestrel accepts newline characters in HTTP/2 request
trailers and values retrieved from the dynamic HPACK table instead of
treating them as malformed.
* SECURITY UPDATE: security feature bypass
- CVE-2026-70194: .NET 11 post-handshake TLS client authentication can fail
to verify the client certificate, allowing mutual-authentication
requirements to be bypassed.
* SECURITY UPDATE: denial of service
- CVE-2026-84008: SignedCms.CheckSignature can repeatedly reparse
attacker-controlled X.509 data, causing unauthenticated quadratic CPU
exhaustion.
* SECURITY UPDATE: information disclosure
- CVE-2026-88092: An aborted Kestrel HTTP/1 connection can reparse unread
request-body bytes as another request, creating a request-smuggling or
desynchronization path.
* SECURITY UPDATE: denial of service
- CVE-2026-92707: SignalR's MessagePack protocol can consume excessive
memory while deserializing deeply nested attacker-controlled arrays,
resulting in unauthenticated remote denial of service.
* SECURITY UPDATE: elevation of privilege
- CVE-2026-96225: Unix named-mutex and shared-memory paths can be
manipulated through insecure global directories, symlink races, and
unsafe permission changes, allowing local attackers to truncate or
overwrite files, widen directory permissions, or elevate privileges.
* SECURITY UPDATE: remote code execution
- CVE-2026-96230: The Blazor WebAssembly development-server debug page can
reflect unencoded exception text, allowing cross-origin script injection
through the unauthenticated /_framework/debug endpoint used by dotnet
watch.
* SECURITY UPDATE: elevation of privilege
- CVE-2026-96231: Unix named-mutex and shared-memory paths can be
manipulated through insecure global directories, symlink races, and
unsafe permission changes, allowing local attackers to truncate or
overwrite files, widen directory permissions, or elevate privileges.
* SECURITY UPDATE: denial of service
- CVE-2026-96233: DateTime Hebrew-number parsing can read outside expected
stack bounds and terminate the process.
* SECURITY UPDATE: denial of service
- CVE-2026-96236: ASP.NET Core request-localization fallback can add
attacker-supplied synthetic culture names to the runtime's global cache,
allowing unauthenticated requests to cause unbounded memory growth and
denial of service.
* SECURITY UPDATE: security feature bypass
- CVE-2026-96238: dotnet new install can acquire a template package from a
feed that is not permitted by NuGet Package Source Mapping, bypassing the
configured feed trust boundary.
* SECURITY UPDATE: security feature bypass
- CVE-2026-96957: Signature verification for .NET file-based apps can fail
to enforce the expected trust decision.
* SECURITY UPDATE: denial of service
- CVE-2026-96958: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: denial of service
- CVE-2026-96959: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* SECURITY UPDATE: denial of service
- CVE-2026-96960: Signed XML fixes add input-depth and operation-count
limits, prohibit DTD processing by default, validate entity references,
bound encrypted-data candidate processing, and cap attributes and
namespaces used by C14N transforms.
* d/p/0009-fix-cecil-writecompressedint32-big-endian.patch: dropped because
it was included upstream.
* d/p/0010-fix-cli-forwarding-paths-nativeaot.patch: dropped because it was
included upstream.
* d/t/regular-tests/debugging-via-dotnet-dump/test.sh: accept the DA
|
