KLA12453 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Visual Studio Code Remote Development Extension can be exploited remotely to execute arbitrary code.
2. A denial of service vulnerability in .NET can be exploited remotely to cause denial of service.

Original advisories

CVE-2022-21991

CVE-2022-21986

Related products

Microsoft-.NET-Framework

Microsoft-Visual-Studio

CVE list

CVE-2022-21991 critical

CVE-2022-21986 critical

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• Visual Studio CodeVisual Studio 2019 for Mac version 8.10Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)Microsoft Visual Studio 2022 version 17.0Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8).NET 5.0.NET 6.0