CVE-2010-4254

Published: Dec 6, 2010Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.

Affected (7)

Products: Mono: Mono · Novell: Moonlight

1 product

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Mono Mono	All versions
Novell Moonlight	Up to 2.3.0
Novell Moonlight	Version 2.99.0
Novell Moonlight	Version 2.99.1
Novell Moonlight	Version 2.99.2
Novell Moonlight	Version 2.99.7
Novell Moonlight	Version 2.99.9

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (26)

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html

Source: secalert@redhat.com

http://secunia.com/advisories/42373

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/42877

Source: secalert@redhat.com

http://www.exploit-db.com/exploits/15974

Source: secalert@redhat.com

http://www.mono-project.com/Vulnerabilities#Moonlight_Generic_Constraints_Bypass_Vulnerability

Source: secalert@redhat.com

http://www.securityfocus.com/bid/45051

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0076

Source: secalert@redhat.com

https://bugzilla.novell.com/show_bug.cgi?id=654136

Source: secalert@redhat.com

https://bugzilla.novell.com/show_bug.cgi?id=655847

Source: secalert@redhat.com

https://github.com/mono/mono/commit/4905ef1130feb26c3150b28b97e4a96752e0d399

Source: secalert@redhat.com

Patch

https://github.com/mono/mono/commit/65292a69c837b8a5f7a392d34db63de592153358

Source: secalert@redhat.com

Patch

https://github.com/mono/mono/commit/cf1ec146f7c6acdc6697032b3aaafc68ffacdcac

Source: secalert@redhat.com

Patch

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42373

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/42877

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/15974

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mono-project.com/Vulnerabilities#Moonlight_Generic_Constraints_Bypass_Vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/45051

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0076

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.novell.com/show_bug.cgi?id=654136

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.novell.com/show_bug.cgi?id=655847

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/mono/mono/commit/4905ef1130feb26c3150b28b97e4a96752e0d399

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/mono/mono/commit/65292a69c837b8a5f7a392d34db63de592153358

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/mono/mono/commit/cf1ec146f7c6acdc6697032b3aaafc68ffacdcac

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.