CVE-2025-21176

Опубликовано: 14 янв. 2025

Источник: redhat

CVSS3: 8.8

EPSS Низкий

Описание

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

A remote code execution vulnerability was found in .NET. This flaw allows an attacker to load a specially crafted file in .NET.

Отчет

This issue affects .NET Framework as shipped with all versions of RHEL. However, this flaw is not known to be exploitable under any supported scenario.

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. No fixes will be provided for this stream. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

Меры по смягчению последствий

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat Enterprise Linux 10	dotnet8.0	Not affected
Red Hat Enterprise Linux 10	dotnet9.0	Not affected
Red Hat Enterprise Linux 9	dotnet6.0	Out of support scope
Red Hat Enterprise Linux 9	dotnet7.0	Out of support scope
Red Hat Enterprise Linux 8	dotnet8.0	Fixed	RHSA-2025:0381	16.01.2025
Red Hat Enterprise Linux 8	dotnet9.0	Fixed	RHSA-2025:0382	16.01.2025
Red Hat Enterprise Linux 9	dotnet8.0	Fixed	RHBA-2025:0304	14.01.2025
Red Hat Enterprise Linux 9	dotnet9.0	Fixed	RHBA-2025:0305	14.01.2025
Red Hat Enterprise Linux 9.4 Extended Update Support	dotnet8.0	Fixed	RHSA-2025:0532	21.01.2025

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Important

Дефект:

CWE-126

https://bugzilla.redhat.com/show_bug.cgi?id=2337926dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

EPSS

Процентиль: 80%

0.01411

Низкий

8.8 High

CVSS3

Связанные уязвимости

CVE-2025-21176

CVSS3: 8.8

ubuntu

около 1 года назад

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

CVE-2025-21176

CVSS3: 8.8

nvd

около 1 года назад

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

CVE-2025-21176

CVSS3: 8.8

msrc

около 1 года назад

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

GHSA-gjf6-3w4p-7xfh

CVSS3: 8.8

github

около 1 года назад

Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability

BDU:2025-00588

CVSS3: 8.8

fstec

около 1 года назад

Уязвимость программных платформ Microsoft .NET Framework, .NET и средства разработки программного обеспечения Microsoft Visual Studio, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 80%

0.01411

Низкий

8.8 High

CVSS3