CVE-2011-0989
mediumpriority · track · 24EPSS 0.027 · 86 %ileEUUSEPSS · scored 2026-10-27
The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which allows remote attackers to modify internal read-only data structures, and cause a denial of service (plugin crash) or corrupt the internal state of the security manager, via a crafted media file, as demonstrated by modifying a C# struct.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (30)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-updates/2011-04/msg00024.htmlcnnvd
- http://openwall.com/lists/oss-security/2011/04/06/14cnnvd
- http://secunia.com/advisories/44002cnnvd
- http://secunia.com/advisories/44076cnnvd
- http://www.mono-project.com/Vulnerabilitiescnnvd
- http://www.securityfocus.com/bid/47208cnnvd
- http://www.vupen.com/english/advisories/2011/0904cnnvd
- http://xforce.iss.net/xforce/xfdb/66624cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan