[ubuntu/questing-security] dotnet9 9.0.116-9.0.15-0ubuntu1~25.10.1 (Accepted)

[Ian Constantin]

dotnet9 (9.0.116-9.0.15-0ubuntu1~25.10.1) questing-security; urgency=medium

  [ Mateus Rodrigues de Morais ]
  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2026-33116: Possible denial of service via infinite recursion in
      XmlDecryptionTransform.
  * SECURITY UPDATE: denial of service
    - CVE-2026-32203: Possible denial of service via stack overflow in
      EncryptedKey nested decryption.
  * SECURITY UPDATE: remote code execution
    - CVE-2026-32178: SMTP command injection and header injection via
      MailAddress parsing flaw in System.Net.Mail.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-26171: denial of service and security feature bypass via unsafe
      transforms in EncryptedXml.

Date: 2026-04-14 21:23:09.394026+00:00
Changed-By: Ian Constantin <ian.constantin at canonical.com>
https://launchpad.net/ubuntu/+source/dotnet9/9.0.116-9.0.15-0ubuntu1~25.10.1
-------------- next part --------------
Sorry, changesfile not available.