Home / mailings

PDF

[USN-8958-1] .NET vulnerabilities

Posted on 30 October 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8958-1
October 29, 2026

dotnet8, dotnet10, dotnet11 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.10
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in .NET

Software Description:
- dotnet10: .NET CLI tools and runtime
- dotnet11: .NET CLI tools and runtime
- dotnet8: .NET CLI tools and runtime

Details:

It was discovered that the .NET Blazor WebAssembly debug proxy did not
properly escape certain values. An attacker could possibly use this issue
to execute arbitrary code. The fix for this CVE was originally released via
USN-8942-1, but it was found to be incomplete. This issue only affected
dotnet10 and dotnet11. (CVE-2026-102870)

It was discovered that the Brotli decompression library used by .NET
incorrectly handled certain compressed streams. A remote attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-111497)

Alen Cheung discovered that .NET did not properly handle file ownership in
certain circumstances. An attacker could possibly use this issue to elevate
local privileges. (CVE-2026-114148)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.10
aspnetcore-runtime-10.0 10.0.14-0ubuntu1~26.10.1
aspnetcore-runtime-11.0 11.0.0~rc3-0ubuntu1~26.10.1
dotnet-host-10.0 10.0.14-0ubuntu1~26.10.1
dotnet-host-11.0 11.0.0~rc3-0ubuntu1~26.10.1
dotnet-hostfxr-10.0 10.0.14-0ubuntu1~26.10.1
dotnet-hostfxr-11.0 11.0.0~rc3-0ubuntu1~26.10.1
dotnet-runtime-10.0 10.0.14-0ubuntu1~26.10.1
dotnet-runtime-11.0 11.0.0~rc3-0ubuntu1~26.10.1
dotnet-sdk-10.0 10.0.114-0ubuntu1~26.10.1
dotnet-sdk-11.0 11.0.100~rc3-0ubuntu1~26.10.1
dotnet-sdk-aot-10.0 10.0.114-0ubuntu1~26.10.1
dotnet-sdk-aot-11.0 11.0.100~rc3-0ubuntu1~26.10.1
dotnet-sdk-dbg-10.0 10.0.114-0ubuntu1~26.10.1
dotnet-sdk-dbg-11.0 11.0.100~rc3-0ubuntu1~26.10.1
dotnet10 10.0.114-10.0.14-0ubuntu1~26.10.1
dotnet11 11.0.100-11.0.0~rc3-0ubuntu1~26.10.1

Ubuntu 26.04 LTS
aspnetcore-runtime-10.0 10.0.14-0ubuntu1~26.04.1
dotnet-host-10.0 10.0.14-0ubuntu1~26.04.1
dotnet-hostfxr-10.0 10.0.14-0ubuntu1~26.04.1
dotnet-runtime-10.0 10.0.14-0ubuntu1~26.04.1
dotnet-sdk-10.0 10.0.114-0ubuntu1~26.04.1
dotnet-sdk-aot-10.0 10.0.114-0ubuntu1~26.04.1
dotnet-sdk-dbg-10.0 10.0.114-0ubuntu1~26.04.1
dotnet10 10.0.114-10.0.14-0ubuntu1~26.04.1

Ubuntu 24.04 LTS
aspnetcore-runtime-10.0 10.0.14-0ubuntu1~24.04.1
aspnetcore-runtime-8.0 8.0.33-0ubuntu1~24.04.1
dotnet-host-10.0 10.0.14-0ubuntu1~24.04.1
dotnet-host-8.0 8.0.33-0ubuntu1~24.04.1
dotnet-hostfxr-10.0 10.0.14-0ubuntu1~24.04.1
dotnet-hostfxr-8.0 8.0.33-0ubuntu1~24.04.1
dotnet-runtime-10.0 10.0.14-0ubuntu1~24.04.1
dotnet-runtime-8.0 8.0.33-0ubuntu1~24.04.1
dotnet-sdk-10.0 10.0.114-0ubuntu1~24.04.1
dotnet-sdk-8.0 8.0.133-0ubuntu1~24.04.1
dotnet-sdk-aot-10.0 10.0.114-0ubuntu1~24.04.1
dotnet-sdk-dbg-10.0 10.0.114-0ubuntu1~24.04.1
dotnet10 10.0.114-10.0.14-0ubuntu1~24.04.1
dotnet8 8.0.133-8.0.33-0ubuntu1~24.04.1

Ubuntu 22.04 LTS
aspnetcore-runtime-8.0 8.0.33-0ubuntu1~22.04.1
dotnet-host-8.0 8.0.33-0ubuntu1~22.04.1
dotnet-hostfxr-8.0 8.0.33-0ubuntu1~22.04.1
dotnet-runtime-8.0 8.0.33-0ubuntu1~22.04.1
dotnet-sdk-8.0 8.0.133-0ubuntu1~22.04.1
dotnet8 8.0.133-8.0.33-0ubuntu1~22.04.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8958-1
CVE-2026-102870, CVE-2026-111497, CVE-2026-114148

Package Information:
https://launchpad.net/ubuntu/+source/dotnet10/10.0.114-10.0.14-0ubuntu1~26.10.1
https://launchpad.net/ubuntu/+source/dotnet11/11.0.100-11.0.0~rc3-0ubuntu1~26.10.1
https://launchpad.net/ubuntu/+source/dotnet10/10.0.114-10.0.14-0ubuntu1~26.04.1
https://launchpad.net/ubuntu/+source/dotnet10/10.0.114-10.0.14-0ubuntu1~24.04.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.133-8.0.33-0ubuntu1~24.04.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.133-8.0.33-0ubuntu1~22.04.1

--===============6703054105195995248==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP