OSVDB ID: 75026

Title: Mono on Moonlight MonoThread Instance Use-after-free Remote Information Disclosure

Info

Disclosure

Apr 06, 2011

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Apr 06, 2011

Description

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Solution: Upgrade
Exploit: Exploit Unknown
Disclosure: Vendor Verified

Solution

Upgrade to version 2.4.1 or higher or 3.99.3 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

CVE ID: 2011-0992 (see also: NVD)
Secunia Advisory ID: 44002 44076 49637
Bugtraq ID: 47208
ISS X-Force ID: 66627
VUPEN Advisory: ADV-2011-0904
Mail List Post: http://lists.opensuse.org/opensuse-updates/2011-04/msg00024.html
Other Advisory URL: http://openwall.com/lists/oss-security/2011/04/06/14
http://www.mono-project.com/Vulnerabilities#Moonlight_RuntimeHelpers.InitializeArray_on_non-primitive_value_types
Vendor Specific News/Changelog Entry: http://security.gentoo.org/glsa/glsa-201206-13.xml
http://www.mono-project.com/Vulnerabilities
https://bugzilla.novell.com/show_bug.cgi?id=667077
https://bugzilla.novell.com/show_bug.cgi?id=678515
https://bugzilla.redhat.com/show_bug.cgi?id=694933
https://github.com/mono/mono/commit/722f9890f09aadfc37ae479e7d946d5fc5ef7b91
Vendor Specific Advisory URL: https://hermes.opensuse.org/messages/7870584

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/75026