Unscored severity · published Dec 3, 2010
CVE-2010-4254
Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic…
–
CVSS
13.6%
EPSS
No
On KEV
Description
Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mono · Mono
All versions, or not specified · source: NVD
MO
Moonlight · Novell
through 2.3.0; 2.99.0; 2.99.1; 2.99.2; 2.99.7; 2.99.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4254
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4254
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
Vendor Advisory
http://secunia.com/advisories/42373
secunia.com
http://secunia.com/advisories/42877
www.exploit-db.com
http://www.exploit-db.com/exploits/15974
www.mono-project.com
http://www.mono-project.com/Vulnerabilities#Moonlight_Generic_Constraints_Bypass_Vulnerability
More from Mono
–
CVE-2012-3382
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote…
–
CVE-2011-0992
Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain…
–
CVE-2011-0991
Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service or possibly have…
–
CVE-2011-0990
Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote…
–
CVE-2011-0989
The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which…