The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with an un-sandboxed Mono CLR interpreter.
References
| Link | Resource |
|---|---|
| https://bugs.debian.org/972146 | Mailing List Mitigation |
| https://lists.debian.org/debian-lts-announce/2023/02/msg00037.html | Mailing List Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2023/01/05/1 | Mailing List Third Party Advisory |
Configurations
History
02 Mar 2023, 20:03
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References | (MISC) https://bugs.debian.org/972146 - Mailing List, Mitigation | |
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2023/02/msg00037.html - Mailing List, Third Party Advisory | |
| References | (MISC) https://www.openwall.com/lists/oss-security/2023/01/05/1 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:mono-project:mono:5.18.0.240\+dfsg-3:*:*:*:*:*:*:* cpe:2.3:a:mono-project:mono:6.8.0.105\+dfsg-3:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Mono-project mono
Mono-project Debian debian Linux Debian |
25 Feb 2023, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Feb 2023, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-22 07:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-26314
Mitre link : CVE-2023-26314
CVE.ORG link : CVE-2023-26314
JSON object : View
Products Affected
mono-project
- mono
debian
- debian_linux
CWE