.NET Framework August 2023 Security and Quality Rollup Updates

Today, we are releasing the August 2023 Security and Quality Rollup Updates for .NET Framework.

Security

CVE-2023-36899– .NET Framework Remote Code Execution Vulnerability

This security update addresses a vulnerability in applications on IIS using their parent application’s Application Pool which can lead to privilege escalation or other security bypasses.

• CVE-2023-36899

CVE-2023-36873– .NET Framework Spoofing Vulnerability

This security update addresses a vulnerability where unauthenticated remote attacker can sign ClickOnce deployments without a valid code signing certificate.

• CVE-2023-36873

Quality and Reliability

This release contains the following quality and reliability improvements.

WPF1

• Addresses an issue where XPS documents using LinkTarget aren’t rendering properly.

Networking

• Addresses an issue where using proxy with continuous load may lead to memory leak resulting in high memory usage, or potentially OutOfMemoryException.

1 Windows Presentation Foundation (WPF)

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog.

Note: Customers that rely on Windows Update and Windows Server Update Services will automatically receive the .NET Framework version-specific updates. Advanced system administrators can also take use of the below direct Microsoft Update Catalog download links to .NET Framework-specific updates. Before applying these updates, please ensure that you carefully review the .NET Framework version applicability, to ensure that you only install updates on systems where they apply.

The following table is for Windows 10, version 1507 and Windows Server 2016 versions and newer operating systems.

The following table is for earlier Windows and Windows Server versions.

Previous Monthly Rollups

The last few .NET Framework Monthly updates are listed below for your convenience: