dotnet9.0-9.0.104-1.fc41
This is the monthly update for .NET 9 for March 2025.
Release Notes:
SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.3/9.0.104.md
Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.3/9.0.3.md
dotnet9.0-9.0.104-1.fc42
This is the monthly update for .NET 9 for March 2025.
Release Notes:
SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.3/9.0.104.md
Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.3/9.0.3.md
USN-7352-1 fixed a vulnerability in FreeType. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This
update also fixes an additional vulnerability in Ubuntu 14.04 LTS.
Original advisory details:
It was discovered that FreeType incorrectly handled certain memory
operations when parsing font subglyph structures. A remote attacker could
use this issue to cause FreeType to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2025-27363)
Additional advisory details:
It was discovered that FreeType incorrectly handled certain memory
operations during typical execution. An attacker could possibly use
this issue to cause FreeType to crash, resulting in a denial of
service. This issue only affected Ubuntu 14.04 LTS. (CVE-2022-27406)
Tobias S. Fink discovered that PlantUML was susceptible to cross-site
scripting attacks (XSS) in instances where SVG images were rendered.
An attacker could possibly use this issue to cause PlantUML to crash,
resulting in a denial of service, or the execution of arbitrary code.
It was discovered that FreeType incorrectly handled certain memory
operations when parsing font subglyph structures. A remote attacker could
use this issue to cause FreeType to crash, resulting in a denial of
service, or possibly execute arbitrary code.
USN-7299-2 fix vulnerabilities in X.Org X Server. This fix caused
a regression in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update
fix the regression and re-apply the fix for the CVE listed.
We apologize for the inconvenience.
Original advisory details:
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
certain memory operations. An attacker could use these issues to cause the
X Server to crash, leading to a denial of service, or possibly execute
arbitrary code.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI Vision Builder AI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-2450.
This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-2449.
An out-of-bounds write vulnerability when attempting to parse font
subglyph structures related to TrueType GX and variable font files was
discovered in FreeType, which may result in the execution of arbitrary
code when processing specially crafted fonts.
Multiple security issues were discovered in the Rails web framework
which could result cross-site scripting, information disclosure, denial
of service or bypass of content security policies.
