[ubuntu/resolute-updates] dotnet10 10.0.107-10.0.7-0ubuntu1~26.04.1 (Accepted)

[Ubuntu Archive Robot]

dotnet10 (10.0.107-10.0.7-0ubuntu1~26.04.1) resolute-security; urgency=medium

  * New upstream release
  * SECURITY UPDATE: elevation of privilege
    - CVE-2026-40372: A bug in Microsoft.AspNetCore.DataProtection
      10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to
      execute an Elevation of Privilege attack by forging authentication
      cookies, and also allows some protected payloads to be decrypted.
  * SECURITY UPDATE: denial of service
    - CVE-2026-33116: Possible denial of service via infinite recursion in
      XmlDecryptionTransform.
  * SECURITY UPDATE: denial of service
    - CVE-2026-32203: Possible denial of service via stack overflow in
      EncryptedKey nested decryption.
  * SECURITY UPDATE: remote code execution
    - CVE-2026-32178: SMTP command injection and header injection via
      MailAddress parsing flaw in System.Net.Mail.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-26171: denial of service and security feature bypass via unsafe
      transforms in EncryptedXml.

Date: 2026-04-22 13:32:10.795262+00:00
Changed-By: Mateus Rodrigues de Morais <mateus.morais at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/dotnet10/10.0.107-10.0.7-0ubuntu1~26.04.1
-------------- next part --------------
Sorry, changesfile not available.