USN-7210-1: .NET vulnerabilities
It was discovered that .NET did not properly handle input provided to its Convert.TryToHexString method. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-21171) It was discovered that .NET did not properly handle an integer overflow when processing certain specially crafted files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-21172) Daniel Plaisted and Noah Gilson discovered that .NET insecurely handled temporary file usage which could result in malicious package dependency injection. An attacker could possibly use this issue to elevate privileges. (CVE-2025-21173) It was discovered that .NET did not properly perform input data validation when processing certain specially crafted files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-21176)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-7210-1?
The severity of USN-7210-1 is considered high due to potential for arbitrary code execution.
How do I fix USN-7210-1?
To fix USN-7210-1, update to the remedial versions of the affected packages: aspnetcore-runtime-8.0 or 9.0, dotnet-host-8.0 or 9.0, dotnet-runtime-8.0 or 9.0, and dotnet-sdk-8.0 or 9.0.
What vulnerabilities are addressed in USN-7210-1?
USN-7210-1 addresses vulnerabilities related to improper input handling and integer overflow in .NET.
Which versions of Ubuntu are affected by USN-7210-1?
USN-7210-1 affects Ubuntu 24.10 and includes specific versions of the .NET packages installed.
Is there a workaround for USN-7210-1 if I cannot update immediately?
There are no official workarounds for USN-7210-1, so immediate updating is recommended to mitigate risk.