KLA50317
Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. Out of bounds memory access vulnerability in Git can be exploited to cause denial of service and gain privileges.
2. Remote code execution vulnerability can be exploited remotely to execute arbitrary code.
3. An information disclosure vulnerability in Visual Studio can be exploited remotely to obtain sensitive information.
4. An elevation of privilege vulnerability in .NET, .NET Framework, and Visual Studio can be exploited remotely to gain privileges.
5. A remote code execution vulnerability in Autodesk® FBX® SDK 2020 can be exploited remotely to execute arbitrary code.
6. A denial of service vulnerability in .NET and Visual Studio can be exploited remotely to cause denial of service.
7. An elevation of privilege vulnerability in .NET and Visual Studio can be exploited remotely to gain privileges.
8. A remote code execution vulnerability in .NET, .NET Framework, and Visual Studio can be exploited remotely to execute arbitrary code.
9. A remote code execution vulnerability in .NET and Visual Studio can be exploited remotely to execute arbitrary code.
10. A spoofing vulnerability in Azure DevOps Server can be exploited remotely to spoof user interface.
11. A remote code execution vulnerability in .NET Framework can be exploited remotely to execute arbitrary code.
12. A spoofing vulnerability in Visual Studio Code can be exploited remotely to spoof user interface.
13. Stack buffer overflow vulnerability in Autodesk® FBX® can be exploited remotely to obtain sensitive information.
14. A remote code execution vulnerability in NuGet Client can be exploited remotely to execute arbitrary code.
15. A denial of service vulnerability in Yet Another Reverse Proxy (YARP) can be exploited remotely to cause denial of service.
16. A denial of service vulnerability in Sysinternals Process Monitor for Windows can be exploited remotely to cause denial of service.
17. A denial of service vulnerability in .NET, .NET Framework, and Visual Studio can be exploited remotely to cause denial of service.
18. Heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 can be exploited remotely to execute arbitrary code.

Public exploits exist for this vulnerability.

NuGet 6.3.2
Microsoft Visual Studio 2013 Update 5
Microsoft Visual Studio 2015 Update 3
Microsoft .NET Framework 3.5 AND 4.8
Microsoft .NET Framework 3.5 AND 4.8.1
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Microsoft Visual Studio 2022 version 17.5
NuGet 6.0.4
Microsoft .NET Framework 3.5 and 4.6.2
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
NuGet 6.4.1
Microsoft .NET Framework 4.8
Azure DevOps Server 2020.1.2
.NET 6.0
Microsoft Visual Studio 2022 version 17.0
NuGet 6.2.3
Microsoft .NET Framework 4.6.2
Microsoft Visual Studio 2022 version 17.2
Microsoft .NET Framework 2.0 Service Pack 2
YARP 2.0
Microsoft .NET Framework 3.0 Service Pack 2
Windows Sysinternals Process Monitor
NuGet 6.5.0
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft Visual Studio 2022 version 17.6
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5 AND 4.7.2
NuGet 6.6.0
Sysinternals Suite
Microsoft Visual Studio 2022 version 17.4
.NET 7.0
Visual Studio Code

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

5027230
5027219
5026454
5027798
5027533
5027539
5027532
5025792
5027119
5026455
5027797
5027540
5027123
5026610
5027537
5027534
5027544
5027543
5027536
5027531
5027541
5027538
5027542