Security Updates For Microsoft Visual Studio Products (august 2022)

0 views

Skip to first unread message

Message has been deleted

Kirby Apodaca

unread,

Jul 13, 2024, 2:48:51 AM7/13/24

to typameti

Visual Studio 2019 version 16.11 is the fifth and final supported servicing baseline for Visual Studio 2019. Enterprise and Professional customers needing to adopt a long term stable and secure development environment are encouraged to standardize on this version. As explained in more detail in our lifecycle and support policy, version 16.11 will be supported with fixes and security updates through April 2029, which is the remainder of the Visual Studio 2019 product lifecycle.

security updates for microsoft visual studio products (august 2022)

Descargar archivo === https://urluss.com/2yOsvj

In addition, now that version 16.11 is available, version 16.9, which was the last servicing baseline, will be supported for an additional 12 months and will go out of support in October 2022. Note as well that versions 16.10 is no longer under support either. These intermediary releases received servicing fixes only until the next minor update released.

You can acquire the latest most secure version of Visual Studio 2019 version 16.11, by visiting the Visual Studio site, or by going to the downloads section of my.visualstudio.com. You can get updates from the Microsoft Update catalog. For more information about Visual Studio supported baselines, please review the support policy for Visual Studio 2019.

The Visual Studio 2019 Blog is the official source of product insight from the Visual Studio Engineering Team. You can find in-depth information about the Visual Studio 2019 releases in the following posts:

CVE-2022-23267 .NET Core Denial of Service VulnerabilityA vulnerability exists in .NET 6.0, .NET 5.0 and .NET Core 3.1 where a malicious client can cause a Denial of Service via excess memory allocations through HttpClient.

CVE-2022-29145 .NET Denial of Service VulnerabilityA vulnerability exists in .NET 6.0, .NET 5.0 and .NET Core 3.1 where a malicious client can can cause a Denial of Service when HTML forms are parsed.

CVE-2022-24513 Elevation of privilege vulnerabilityA potential elevation of privilege vulnerability exists when the Microsoft Visual Studio updater service improperly parses local configuration data.

CVE-2022-24765 Elevation of privilege vulnerabilityA potential elevation of privilege vulnerability exists in Git for Windows, in which Git operations could run outside a repository while seraching for a Git directory. Git for Windows is now updated to version 2.35.2.1.

CVE-2022-24767 DLL hijacking vulnerabilityA potential DLL hijacking vulnerability exists in Git for Windows installer, when running the uninstaller under the SYSTEM user account. Git for Windows is now updated to version 2.35.2.1.

CVE-2021-3711 OpenSSL Buffer Overflow vulnerabilityA potential buffer overflow vulnerability exists in OpenSSL, which is consumed by Git for Windows. Git for Windows is now updated to version 2.35.1.2, which addresses this issue.

To prevent a potentially malicious exploit that allows code to be misrepresented, the Visual Studio editor will no longer allow bidirectional text control characters to manipulate the order of characters on the editing surface. A new option will cause these bidirectional text control characters to be shown with placeholders. The bidirectional text control characters will still be present in the code as this behavior only impacts what is rendered in the code editor.

CVE-2021-43877 .NET VulnerabilityAn elevation of privilege vulnerability exists in ANCM which could allow elevation of privilege when .NET core, .NET 5 and .NET 6 applications are hosted within IIS.

CVE-2021-42574 Bidirectional Text VulnerabilityBidirectional text control characters can be used to cause code to be rendered in the editor differently from what is contained on disk.

CVE-2021-42277 Diagnostics Hub Standard Collector Service Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector incorrectly handles file operations.

A permission assignment vulnerability exists in Visual Studio after installing the Game development with C++ and selecting the Unreal Engine Installer workload. The system is vulnerable to LPE during the installation it creates a directory with write access to all users.

In this update of Visual Studio this new experience is available when running your application under the debugger (F5) and is powered by the Edit and Continue (EnC) mechanism. Therefore, anywhere that EnC is supported you can now also use Hot Reload alongside any other debugger features. .NET Hot Reload will also work alongside XAML Hot Reload, making it possible to make both UI and code-behind changes in your desktop applications such as WPF or WinUI.

Both EnC and Hot Reload also share the same limitations, so be aware that not every type of edit is currently supported. The complete list of what is or is not supported can be found in our documentation.

We would love to hear from you! For issues, let us know through the Report a Problem option in the upper right-handcorner of either the installer or the Visual Studio IDE itself. The icon is located in the upper right-hand corner.You can make a product suggestion or track your issues in the Visual Studio Developer Community, where you can ask questions, find answers, and propose new features.You can also get free installation help through our Live Chat support.

Visual Studio Code is a streamlined code editor with support for development operations like debugging, task running, and version control. It aims to provide just the tools a developer needs for a quick code-build-debug cycle and leaves more complex workflows to fuller featured IDEs, such as Visual Studio IDE.

Important Notice: VS Code gives you the option to install Microsoft and third party extensions. These extensions may be collecting their own usage data and are not controlled by the telemetry.telemetryLevel setting. Consult the specific extension's documentation to learn about its telemetry reporting.

VS Code uses experiments to try out new features or progressively roll them out. Our experimentation framework calls out to a Microsoft-owned service and is therefore disabled when telemetry is disabled. However, if you want to disable experiments regardless of your telemetry preferences, you may set the workbench.enableExperiments user setting to false.

From File > Preferences > Settings, search for telemetry, and set the Telemetry: Telemetry Level setting to off. This will silence all telemetry events including crash reporting from VS Code. You will need to restart VS Code for the setting change to take effect.

Now that the General Data Protection Regulation (GDPR) is in effect, we want to take this opportunity to reiterate that we take privacy very seriously. That's both for Microsoft as a company and specifically within the VS Code team.

Beyond crash reporting and telemetry, VS Code uses online services for various other purposes such as downloading product updates, finding, installing, and updating extensions, or providing Natural Language Search within the Settings editor. You can learn more in Managing online services.

You can choose to turn on/off features that use these services. From File > Preferences > Settings, and type the tag @tag:usesOnlineServices. This will display all settings that control the usage of online services and you can individually switch them on or off.

By default, VS Code is set up to auto-update for macOS and Windows users when we release new updates. If you do not want to get automatic updates, you can set the Update: Mode setting from default to none.

Note: On Linux: If the VS Code repository was installed correctly then your system package manager should handle auto-updating in the same way as other packages on the system. See Installing VS Code on Linux.

You can find the VS Code licenses, third party notices and Chromium Open Source credit list under your VS Code installation location resources\app folder. VS Code's ThirdPartyNotices.txt, Chromium's Credits_*.html, and VS Code's English language LICENSE.txt are available under resources\app. Localized versions of LICENSE.txt by language ID are under resources\app\licenses.

The github.com/microsoft/vscode repository (Code - OSS) is where we develop the Visual Studio Code product. Not only do we write code and work on issues there, we also publish our roadmap and monthly iteration and endgame plans. The source code is available to everyone under a standard MIT license.

Microsoft Visual Studio Code is a Microsoft licensed distribution of 'Code - OSS' that includes Microsoft proprietary assets (such as icons) and features (Visual Studio Marketplace integration, small aspects of enabling Remote Development). While these additions make up a very small percentage of the overall distribution code base, it is more accurate to say that Visual Studio Code is "built" on open source, rather than "is" open source, because of these differences. More information on what each distribution includes can be found in the Visual Studio Code and 'Code - OSS' Differences article.

Extension authors are free to choose a license that fits their business needs. While many extension authors have opted to release their source code under an open-source license, some extensions like Wallaby.js, Google Cloud Code, and the VS Code Remote Development extensions use proprietary licenses.

At Microsoft, we open source our extensions whenever possible. However, reliance on existing proprietary source code or libraries, source code that crosses into Microsoft licensed tools or services (for example Visual Studio), and business model differences across the entirety of Microsoft will result in some extensions using a proprietary license. You can find a list of Microsoft contributed Visual Studio Code extensions and their licenses in the Microsoft Extension Licenses article.