Other changes:

Bug Fixes & Known Issues
Related releases:

Team Foundation Server 2015 CTP 

Fixed In This Release of Visual Studio 2019 version 16.5

• Team Explorer not loading after update to mandatory latest visual studio version for Visual studio 2019
• Find Highlighting Fails when Matching with Match Case Disabled and Regex Option Enabled

Security Advisory Notice

CVE-2020-1108 .NET Core Denial of Service Vulnerability

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET Core application. The security update addresses the vulnerability by correcting how the .NET Core web application handles web requests.

CVE-2020-1161 .NET Core Denial of Service Vulnerability

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. The security update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests. 

These are the customer-reported issues addressed in 15.7.1:

• This release includes a fix that reduces memory usage and GC pressure during solution load.

Microsoft Security Advisory for .NET Core Denial Of Service Vulnerability

CVE-2018-0765

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core and .NET native version 2.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a denial of service vulnerability that exists when .NET Framework and .NET Core improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Framework, .NET Core, or .NET native application.

The update addresses the vulnerability by correcting how .NET Framework, .NET Core, and .NET native applications handle XML document processing.

If your application is an ASP.NET Core application, developers are also advised to update to ASP.NET Core 2.0.8. 

 npm install @aspnet/signalr-client --save

npm init
npm install @aspnet/signalr-client --save
bower install

[
  {
    "outputFileName": "wwwroot/css/site.min.css",
    "inputFiles": [
      "wwwroot/lib/bootstrap/dist/css/bootstrap.min.css",
      "wwwroot/css/site.css"
    ]
  },
  {
    "outputFileName": "wwwroot/js/site.min.js",
    "inputFiles": [
      "wwwroot/lib/jquery/dist/jquery.min.js",
      "wwwroot/lib/bootstrap/dist/js/bootstrap.min.js",
      "node_modules/@aspnet/signalr-client/dist/browser/signalr-client-1.0.0-alpha1-final.min.js",
      "wwwroot/lib/jquery-validation/dist/jquery.validate.min.js",
      "wwwroot/lib/jquery-validation-unobtrusive/jquery.validate.unobtrusive.min.js",
      "wwwroot/lib/jquery-ajax-unobtrusive/jquery.unobtrusive-ajax.min.js",
      "wwwroot/js/site.js"
    ],
    "minify": {
      "enabled": false,
      "renameLocals": false
    },
    "sourceMap": false
  }
]

<link href="~/css/site.min.css" rel="stylesheet" asp-append-version="true" />
<script src="~/js/site.min.js" type="text/javascript" asp-append-version="true"></script>

public class MessageHub : Hub
{
   public Task Send(string message)
   {
     return Clients.All.InvokeAsync("broadcastMessage", message);
   }
}

<form method="post"
      asp-action="Index"
      asp-controller="Home"
      data-ajax="true"
      role="form">
  <div class="form-group">
     <label label-for="message">Message: </label>
     <input id="message" name="message" class="form-control"/>
  </div>
  <button class="btn btn-primary" type="submit">Send To Home/Index</button>
  <button class="btn btn-success" id="sendmessageDirect" type="button">Send To /message hub directly</button>
</form>

<div id="discussion">
</div>

@section Scripts
{
   <script type="text/javascript" asp-append-version="true">
   $(function() {
      var connection = new signalR.HubConnection('/message');
      connection.on('broadcastMessage', function (message) {
          // Add the message to the page.
          var encodedMsg = $('<div />').text(message).html();
          $('#discussion').append('<li>' + encodedMsg + '</li>');
      });

      connection.start().then(function () {
          console.log('connected.');
          $('#sendmessageDirect').click(function () {
              // Call the Send method on the hub.
              connection.invoke('send', $('#message').val());
          });
      });
   });
   </script>
}

dotnet restore
npm install
npm install -g bower
bower install
dotnet watch run

Here’s what’s new in this preview release:

• .NET Hot Reload updates for dotnet watch
• ASP.NET Core SPA templates updated to Angular 11 and React 17
• Use Razor syntax in SVG foreignObject elements
• Specify null for Action and RenderFragment component parameters
• Reduced Blazor WebAssembly download size with runtime relinking
• Configurable buffer threshold before writing to disk in Json.NET output formatter
• Subcategories for better filtering of Kestrel logs
• Faster get and set for HTTP headers
• Configurable unconsumed incoming buffer size for IIS 

Security Advisory Notices

CVE-2019-1077 Visual Studio Extension Auto Update Vulnerability

An elevation of privilege vulnerability exists when the Visual Studio Extension auto-update process improperly performs certain file operations. An attacker who successfully exploited this vulnerability could delete files in arbitrary locations. To exploit this vulnerability, an attacker would require unprivileged access to a vulnerable system. The security update addresses the vulnerability by securing locations the Visual Studio Extension auto-update performs file operations in.

CVE-2019-1075 ASP.NET Core Spoofing Vulnerability

A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect. An attacker who successfully exploited the vulnerability could redirect a targeted user to a malicious website. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.

The security update addresses the vulnerability by correcting how ASP.NET Core parses URLs. Details can be found in the .NET Core release notes.

CVE-2019-1113 WorkflowDesigner XOML deserialization allows code execution

A XOML file referencing certain types could cause random code to be executed when the XOML file is opened in Visual Studio. There is now a restriction on what types are allowed to be used in XOML files. If a XOML file containing one of the newly unauthorized types is opened, a message is displayed explaining that the type is unauthorized.

For further information, please refer to https://support.microsoft.com/en-us/help/4512190/remote-code-execution-vulnerability-if-types-are-specified-in-xoml.

These are the issues addressed in 15.9.14:

• Fixed a bug causing Visual Studio 2017 crashes when switching branches.
• Fixed a bug causing internal compiler error (fbtctree.cpp', line 5540) during code analysis.
• Fixed a performance regression in memcpy/memset for Ryzen processors.
• Updated Service Fabric tooling to support the 6.5 Service Fabric release.
• Enabled screen reader to announce TeamExplorer's notifications properly on .NET 4.8.
• VS2017 15.8 Internal compiler error ('msc1.cpp', line 1518): Conflict between preprocessor and #import.
• ICE in PREfast 19.16.27023.1 (15.9 RTW).

Security Advisory Notices

• Visual Studio Extension Auto Update Vulnerability
• Visual Studio WorkFlowMarkUpDeserializerRCE Vulernability
• ASP.NET Core Spoofing Vulnerability 

• Modal progress dialog stays open permanently even when IDE is responsive ('Preparing Solution', 'Creating Project', Edit and Continue, etc).
• PackageId:OpenJDKV1;PackageAction:Uninstall;ReturnCode:0;.
• .sql files are empty.
• Properties Window in Forms Designer shows vertical scrollbar without drag handle with automatic scaling on 4K display in Visual Studio 2019 RC.
• VSIXInstaller.exe crashes randomly when installing multiple extensions sequentially in Visual Studio 2019 RC.1.
• MSBuild failure when executing multi-line Exec commands.
• You can now use Time Travel Debugging with the snapshot debugger on ASP.NET Apps running on an Azure VM. Please note that this feature may not work in all Azure regions at release. 

No Authentication