USN-8942-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8942-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8942-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8942-1
Upstream
CVE (28)
Published
2026-10-20T15:15:07Z
Modified
2026-10-21T04:43:06Z
Summary
dotnet8, dotnet10, dotnet11 vulnerabilities
Details

Multiple security issues were discovered in .NET and this update includes new upstream .NET versions to fix these issues.

.NET 8 has been updated to 8.0.32 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. .NET 10 has been updated to 10.0.13 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. .NET 11 has been updated to 11.0.0~rc2 in Ubuntu 26.10.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

References

Affected packages

Ubuntu:22.04:LTS
dotnet8

Package

Name
dotnet8
Purl
pkg:deb/ubuntu/dotnet8?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.132-8.0.32-0ubuntu1~22.04.1

Affected versions

8.*
8.0.102-8.0.2-0ubuntu1~22.04.1
8.0.103-8.0.3-0ubuntu1~22.04.1
8.0.103-8.0.3-0ubuntu1~22.04.2
8.0.105-8.0.5-0ubuntu1~22.04.1
8.0.107-8.0.7-0ubuntu1~22.04.1
8.0.108-8.0.8-0ubuntu1~22.04.1
8.0.110-8.0.10-0ubuntu1~22.04.1
8.0.111-8.0.11-0ubuntu1~22.04.1
8.0.112-8.0.12-0ubuntu1~22.04.1
8.0.114-8.0.14-0ubuntu1~22.04.1
8.0.115-8.0.15-0ubuntu1~22.04.1
8.0.116-8.0.16-0ubuntu1~22.04.1
8.0.117-8.0.17-0ubuntu1~22.04.1
8.0.118-8.0.18-0ubuntu1~22.04.1
8.0.119-8.0.19-0ubuntu1~22.04.1
8.0.120-8.0.20-0ubuntu1~22.04.1
8.0.121-8.0.21-0ubuntu1~22.04.1
8.0.122-8.0.22-0ubuntu1~22.04.1
8.0.123-8.0.23-0ubuntu1~22.04.1
8.0.124-8.0.24-0ubuntu1~22.04.1
8.0.125-8.0.25-0ubuntu1~22.04.1
8.0.126-8.0.26-0ubuntu1~22.04.1
8.0.127-8.0.27-0ubuntu1~22.04.1
8.0.128-8.0.28-0ubuntu1~22.04.1
8.0.129-8.0.29-0ubuntu1~22.04.1
8.0.130-8.0.30-0ubuntu1~22.04.1
8.0.131-8.0.31-0ubuntu1~22.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-host-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0",
            "binary_version":  "8.0.132-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0-source-built-artifacts",
            "binary_version":  "8.0.132-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-8.0",
            "binary_version":  "8.0.132-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-8.0",
            "binary_version":  "8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet-templates-8.0",
            "binary_version":  "8.0.132-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "dotnet8",
            "binary_version":  "8.0.132-8.0.32-0ubuntu1~22.04.1"
        },
        {
            "binary_name":  "netstandard-targeting-pack-2.1-8.0",
            "binary_version":  "8.0.132-0ubuntu1~22.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8942-1.json"
Ubuntu:24.04:LTS
dotnet10

Package

Name
dotnet10
Purl
pkg:deb/ubuntu/dotnet10?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.0.113-10.0.13-0ubuntu1~24.04.1

Affected versions

10.*
10.0.100-10.0.0-0ubuntu1~24.04.1
10.0.101-10.0.1-0ubuntu1~24.04.2
10.0.103-10.0.3-0ubuntu1~24.04.1
10.0.104-10.0.4-0ubuntu1~24.04.1
10.0.105-10.0.5-0ubuntu1~24.04.1
10.0.106-10.0.6-0ubuntu1~24.04.1
10.0.107-10.0.7-0ubuntu1~24.04.1
10.0.108-10.0.8-0ubuntu1~24.04.1
10.0.109-10.0.9-0ubuntu1~24.04.1
10.0.110-10.0.10-0ubuntu1~24.04.1
10.0.111-10.0.11-0ubuntu1~24.04.1
10.0.112-10.0.12-0ubuntu1~24.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-host-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0",
            "binary_version":  "10.0.113-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version":  "10.0.113-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-10.0",
            "binary_version":  "10.0.113-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-10.0",
            "binary_version":  "10.0.113-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-templates-10.0",
            "binary_version":  "10.0.113-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet10",
            "binary_version":  "10.0.113-10.0.13-0ubuntu1~24.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8942-1.json"
dotnet8

Package

Name
dotnet8
Purl
pkg:deb/ubuntu/dotnet8?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.132-8.0.32-0ubuntu1~24.04.1

Affected versions

8.*
8.0.100-8.0.0~rc1-0ubuntu1
8.0.100-8.0.0~rc2-0ubuntu1
8.0.100-8.0.0~rc2-0ubuntu2
8.0.100-8.0.0-0ubuntu1
8.0.100-8.0.0-0ubuntu2
8.0.101-8.0.1-0ubuntu1
8.0.101-8.0.1-0ubuntu2
8.0.102-8.0.2-0ubuntu1
8.0.103-8.0.3-0ubuntu2
8.0.103-8.0.3-0ubuntu3
8.0.104-8.0.4-0ubuntu1
8.0.105-8.0.5-0ubuntu1~24.04.1
8.0.107-8.0.7-0ubuntu1~24.04.1
8.0.108-8.0.8-0ubuntu1~24.04.1
8.0.108-8.0.8-0ubuntu1~24.04.2
8.0.110-8.0.10-0ubuntu1~24.04.1
8.0.111-8.0.11-0ubuntu1~24.04.1
8.0.112-8.0.12-0ubuntu1~24.04.1
8.0.114-8.0.14-0ubuntu1~24.04.1
8.0.115-8.0.15-0ubuntu1~24.04.1
8.0.116-8.0.16-0ubuntu1~24.04.1
8.0.117-8.0.17-0ubuntu1~24.04.1
8.0.118-8.0.18-0ubuntu1~24.04.1
8.0.119-8.0.19-0ubuntu1~24.04.1
8.0.120-8.0.20-0ubuntu1~24.04.1
8.0.121-8.0.21-0ubuntu1~24.04.1
8.0.122-8.0.22-0ubuntu1~24.04.1
8.0.123-8.0.23-0ubuntu1~24.04.1
8.0.124-8.0.24-0ubuntu1~24.04.1
8.0.125-8.0.25-0ubuntu1~24.04.1
8.0.126-8.0.26-0ubuntu1~24.04.1
8.0.127-8.0.27-0ubuntu1~24.04.1
8.0.128-8.0.28-0ubuntu1~24.04.1
8.0.129-8.0.29-0ubuntu1~24.04.1
8.0.130-8.0.30-0ubuntu1~24.04.1
8.0.131-8.0.31-0ubuntu1~24.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-host-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0",
            "binary_version":  "8.0.132-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-8.0-source-built-artifacts",
            "binary_version":  "8.0.132-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-8.0",
            "binary_version":  "8.0.132-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-8.0",
            "binary_version":  "8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet-templates-8.0",
            "binary_version":  "8.0.132-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "dotnet8",
            "binary_version":  "8.0.132-8.0.32-0ubuntu1~24.04.1"
        },
        {
            "binary_name":  "netstandard-targeting-pack-2.1-8.0",
            "binary_version":  "8.0.132-0ubuntu1~24.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8942-1.json"
Ubuntu:26.04:LTS
dotnet10

Package

Name
dotnet10
Purl
pkg:deb/ubuntu/dotnet10?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.0.113-10.0.13-0ubuntu1~26.04.1

Affected versions

10.*
10.0.100-10.0.0~rc1-0ubuntu1
10.0.100-10.0.0~rc2-0ubuntu1
10.0.100-10.0.0-0ubuntu1
10.0.100-10.0.0-0ubuntu2
10.0.101-10.0.1-0ubuntu1
10.0.101-10.0.1-0ubuntu2
10.0.101-10.0.1-0ubuntu3
10.0.102-10.0.2-0ubuntu1
10.0.103-10.0.3-0ubuntu1
10.0.104-10.0.4-0ubuntu1
10.0.105-10.0.5-0ubuntu1
10.0.107-10.0.7-0ubuntu1~26.04.1
10.0.108-10.0.8-0ubuntu1~26.04.1
10.0.109-10.0.9-0ubuntu1~26.04.1
10.0.110-10.0.10-0ubuntu1~26.04.1
10.0.111-10.0.11-0ubuntu1~26.04.1
10.0.112-10.0.12-0ubuntu1~26.04.1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-host-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version":  "10.0.113-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet-templates-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.04.1"
        },
        {
            "binary_name":  "dotnet10",
            "binary_version":  "10.0.113-10.0.13-0ubuntu1~26.04.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:26.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8942-1.json"
Ubuntu:26.10
dotnet10

Package

Name
dotnet10
Purl
pkg:deb/ubuntu/dotnet10?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
10.0.113-10.0.13-0ubuntu1~26.10.1

Affected versions

10.*
10.0.105-10.0.5-0ubuntu1
10.0.107-10.0.7-0ubuntu1~26.04.1
10.0.108-10.0.8-0ubuntu1
10.0.109-10.0.9-0ubuntu1
10.0.110-10.0.10-0ubuntu3
10.0.111-10.0.11-0ubuntu1
10.0.112-10.0.12-0ubuntu1
10.0.112-10.0.12-0ubuntu2

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-host-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-10.0-source-built-artifacts",
            "binary_version":  "10.0.113-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-10.0",
            "binary_version":  "10.0.13-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-templates-10.0",
            "binary_version":  "10.0.113-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet10",
            "binary_version":  "10.0.113-10.0.13-0ubuntu1~26.10.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8942-1.json"
dotnet11

Package

Name
dotnet11
Purl
pkg:deb/ubuntu/dotnet11?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.0.100-11.0.0~rc2-0ubuntu1~26.10.1

Affected versions

11.*
11.0.100-11.0.0~rc1-0ubuntu1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "aspnetcore-runtime-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-runtime-dbg-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "aspnetcore-targeting-pack-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-apphost-pack-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-host-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-hostfxr-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-runtime-dbg-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-11.0",
            "binary_version":  "11.0.100~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-11.0-source-built-artifacts",
            "binary_version":  "11.0.100~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-aot-11.0",
            "binary_version":  "11.0.100~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-sdk-dbg-11.0",
            "binary_version":  "11.0.100~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-targeting-pack-11.0",
            "binary_version":  "11.0.0~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet-templates-11.0",
            "binary_version":  "11.0.100~rc2-0ubuntu1~26.10.1"
        },
        {
            "binary_name":  "dotnet11",
            "binary_version":  "11.0.100-11.0.0~rc2-0ubuntu1~26.10.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8942-1.json"