.NET Security Feature Bypass Vulnerability

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

.NET Core and Visual Studio Information Disclosure Vulnerability

Visual Studio Elevation of Privilege Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Visual Studio Information Disclosure Vulnerability

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.

Visual Studio Remote Code Execution Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files, aka 'Git for Visual Studio Elevation of Privilege Vulnerability'.

A vulnerability was found in Git. This security flaw occurs when renaming or deleting a section from a configuration file, where certain malicious configuration values may be misinterpreted as the beginning of a new configuration section. This flaw leads to arbitrary configuration injection.

A vulnerability was found in Git. This security flaw occurs when Git compiles with runtime prefix support and runs without translated messages, and it still uses the gettext machinery to display messages, which subsequently looks for translated messages in unexpected places. This flaw allows the malicious placement of crafted messages.

A vulnerability was found in Git. This security flaw occurs when feeding specially crafted input to git apply --reject; a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch.

Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to remote code execution. This issue only affects Windows systems.

Note: The vulnerabilities CVE-2023-36792, CVE-2023-36793, CVE-2023-36792, CVE-2023-36796 are all resolved by a single patch. Get affected software to resolve all of them.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/91944

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

Any .NET 7.0 application running on .NET 7.0.10 or earlier. Any .NET 6.0 application running on .NET 6.0.21 or earlier.

If your application uses the following package versions, ensure you update to the latest version of .NET.

<a name=".NET 7"></a>.NET 7

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x86 | >= 7.0.0, <= 7.0.10 | 7.0.11

<a name=".NET 6"></a>.NET 6

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x86 | >= 6.0.0, <= 6.0.21 | 6.0.22

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

To fix the issue please install the latest version of .NET 6.0 or .NET 7.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. If you are using one of the affected packages, please update to the patched version listed above. If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET Core SDK (reflecting any global.json):

Version: 6.0.300 Commit: 8473146e7d

Runtime Environment:

OS Name: Windows OS Version: 10.0.18363 OS Platform: Windows RID: win10-x64 Base Path: C:\Program Files\dotnet\sdk\6.0.300\

Host (useful for support):

Version: 6.0.5 Commit: 8473146e7d

.NET Core SDKs installed:

6.0.300 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:

Microsoft.AspNetCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs: https://aka.ms/dotnet-download

If you're using .NET 7.0, you should download and install Runtime 7.0.11 or SDK 7.0.111 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0. If you're using .NET 6.0, you should download and install Runtime 6.0.22 or SDK 6.0.317 (for Visual Studio 2022 v17.2) from https://dotnet.microsoft.com/download/dotnet-core/6.0.

.NET 6.0 and and .NET 7.0 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 6.0 or .NET 7.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2023-36792

Revisions

V1.0 (September 12, 2023): Advisory published.

Version 1.0

Last Updated 2023-09-12

Microsoft Security Advisory CVE-2023-36793: .NET Remote Code Execution Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to remote code execution. This issue only affects Windows systems.

Note: The vulnerabilities CVE-2023-36792, CVE-2023-36793, CVE-2023-36792, CVE-2023-36796 are all resolved by a single patch. Get affected software to resolve all of them.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/91947

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

Any .NET 7.0 application running on .NET 7.0.10 or earlier. Any .NET 6.0 application running on .NET 6.0.21 or earlier.

If your application uses the following package versions, ensure you update to the latest version of .NET.

<a name=".NET 7"></a>.NET 7

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x86 | >= 7.0.0, <= 7.0.10 | 7.0.11

<a name=".NET 6"></a>.NET 6

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x86 | >= 6.0.0, <= 6.0.21 | 6.0.22

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

To fix the issue please install the latest version of .NET 6.0 or .NET 7.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. If you are using one of the affected packages, please update to the patched version listed above. If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET Core SDK (reflecting any global.json):

Version: 6.0.300 Commit: 8473146e7d

Runtime Environment:

OS Name: Windows OS Version: 10.0.18363 OS Platform: Windows RID: win10-x64 Base Path: C:\Program Files\dotnet\sdk\6.0.300\

Host (useful for support):

Version: 6.0.5 Commit: 8473146e7d

.NET Core SDKs installed:

6.0.300 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:

Microsoft.AspNetCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs: https://aka.ms/dotnet-download

If you're using .NET 7.0, you should download and install Runtime 7.0.11 or SDK 7.0.111 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0. If you're using .NET 6.0, you should download and install Runtime 6.0.22 or SDK 6.0.317 (for Visual Studio 2022 v17.2) from https://dotnet.microsoft.com/download/dotnet-core/6.0.

.NET 6.0 and and .NET 7.0 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 6.0 or .NET 7.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2023-36793

Revisions

V1.0 (September 12, 2023): Advisory published.

Version 1.0

Last Updated 2023-09-12

Microsoft Security Advisory CVE-2023-36794: .NET Remote Code Execution Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to remote code execution. This issue only affects Windows systems.

Note: The vulnerabilities CVE-2023-36792, CVE-2023-36793, CVE-2023-36792, CVE-2023-36796 are all resolved by a single patch. Get affected software to resolve all of them.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/91946

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

Any .NET 7.0 application running on .NET 7.0.10 or earlier. Any .NET 6.0 application running on .NET 6.0.21 or earlier.

If your application uses the following package versions, ensure you update to the latest version of .NET.

<a name=".NET 7"></a>.NET 7

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x86 | >= 7.0.0, <= 7.0.10 | 7.0.11

<a name=".NET 6"></a>.NET 6

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x86 | >= 6.0.0, <= 6.0.21 | 6.0.22

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

To fix the issue please install the latest version of .NET 6.0 or .NET 7.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. If you are using one of the affected packages, please update to the patched version listed above. If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET Core SDK (reflecting any global.json):

Version: 6.0.300 Commit: 8473146e7d

Runtime Environment:

OS Name: Windows OS Version: 10.0.18363 OS Platform: Windows RID: win10-x64 Base Path: C:\Program Files\dotnet\sdk\6.0.300\

Host (useful for support):

Version: 6.0.5 Commit: 8473146e7d

.NET Core SDKs installed:

6.0.300 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:

Microsoft.AspNetCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs: https://aka.ms/dotnet-download

If you're using .NET 7.0, you should download and install Runtime 7.0.11 or SDK 7.0.111 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0. If you're using .NET 6.0, you should download and install Runtime 6.0.22 or SDK 6.0.317 (for Visual Studio 2022 v17.2) from https://dotnet.microsoft.com/download/dotnet-core/6.0.

.NET 6.0 and and .NET 7.0 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 6.0 or .NET 7.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2023-36794

Revisions

V1.0 (September 12, 2023): Advisory published.

Version 1.0

Last Updated 2023-09-12

Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in Microsoft.DiaSymReader.Native.amd64.dll when reading a corrupted PDB file which may lead to remote code execution. This issue only affects Windows systems.

Note: The vulnerabilities CVE-2023-36792, CVE-2023-36793, CVE-2023-36792, CVE-2023-36796 are all resolved by a single patch. Get affected software to resolve all of them.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/runtime/issues/91948

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

Any .NET 7.0 application running on .NET 7.0.10 or earlier. Any .NET 6.0 application running on .NET 6.0.21 or earlier.

If your application uses the following package versions, ensure you update to the latest version of .NET.

<a name=".NET 7"></a>.NET 7

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x64 | >= 7.0.0, <= 7.0.10 | 7.0.11 Microsoft.NETCore.App.Runtime.win-x86 | >= 7.0.0, <= 7.0.10 | 7.0.11

<a name=".NET 6"></a>.NET 6

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.NETCore.App.Runtime.win-arm64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x64 | >= 6.0.0, <= 6.0.21 | 6.0.22 Microsoft.NETCore.App.Runtime.win-x86 | >= 6.0.0, <= 6.0.21 | 6.0.22

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

To fix the issue please install the latest version of .NET 6.0 or .NET 7.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. If you are using one of the affected packages, please update to the patched version listed above. If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET Core SDK (reflecting any global.json):

Version: 6.0.300 Commit: 8473146e7d

Runtime Environment:

OS Name: Windows OS Version: 10.0.18363 OS Platform: Windows RID: win10-x64 Base Path: C:\Program Files\dotnet\sdk\6.0.300\

Host (useful for support):

Version: 6.0.5 Commit: 8473146e7d

.NET Core SDKs installed:

6.0.300 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:

Microsoft.AspNetCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs: https://aka.ms/dotnet-download

If you're using .NET 7.0, you should download and install Runtime 7.0.11 or SDK 7.0.111 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0. If you're using .NET 6.0, you should download and install Runtime 6.0.22 or SDK 6.0.317 (for Visual Studio 2022 v17.2) from https://dotnet.microsoft.com/download/dotnet-core/6.0.

.NET 6.0 and and .NET 7.0 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 6.0 or .NET 7.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/aspnet/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2023-36796

Revisions

V1.0 (September 12, 2023): Advisory published.

Version 1.0

Last Updated 2023-09-12

.NET Spoofing Vulnerability

Visual Studio Remote Code Execution Vulnerability

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when gitk is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using gitk (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.

.NET and Visual Studio Remote Code Execution Vulnerability

An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or information disclosure.

A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.

A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.

Visual Studio Spoofing Vulnerability

Visual Studio Remote Code Execution Vulnerability

Description The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format key=value. Git's documentation restricts the use of the NUL (\0) character and newlines to form part of the keys[^1] or values.

When Git reads from standard input, it considers both LF and CRLF[^2] as newline characters for the credential protocol by virtue of calling strbufgetline that calls to strbufgetdelimstripcrlf. Git also validates that a newline is not present in the value by checking for the presence of the line-feed character (LF, \n), and errors if this is the case. This captures both LF and CRLF-type newlines.

Git Credential Manager uses the .NET standard library StreamReader class to read the standard input stream line-by-line and parse the key=value credential protocol format. The implementation of the ReadLineAsync method considers LF, CRLF, and CR as valid line endings. This is means that .NET considers a single CR as a valid newline character, whereas Git does not.

This mismatch of newline treatment between Git and GCM means that an attacker can craft a malicious remote URL such as:

https://\rhost=targethost@badhost

..which will be interpreted by Git as:

protocol=https host=badhost username=\rhost=targethost

This will instead be parsed by GCM as if the following has been passed by Git:

protocol=https host=badhost username= host=targethost

This results in the host field being resolved to the targethost value. GCM will then return a credential for targethost to Git, which will then send this credential to the badhost host.

Impact When a user clones or otherwise interacts[^3] with a malicious repository that requires authentication, the attacker can capture credentials for another Git remote. The attack is also heightened when cloning from repositories with submodules when using the --recursive clone option as the user is not able to inspect the submodule remote URLs beforehand.

Patches https://github.com/git-ecosystem/git-credential-manager/compare/749e287571c78a2b61f926ccce6a707050871ab8...99e2f7f60e7364fe807e7925f361a81f3c47bd1b

Workarounds Only interacting with trusted remote repositories, and do not clone with --recursive to allow inspection of any submodule URLs before cloning those submodules.

Fixed versions This issue is fixed as of version 2.6.1.

[^1]: The = character is also forbidden to form part of the key. [^2]: Carriage-return character (CR, \r), followed by a line-feed character. [^3]: Any remote operation such as fetch, ls-remote, etc.

Visual Studio Remote Code Execution Vulnerability