CVE-2023-26314
Fixed in a distro release EPSS <1%CVSS 8.8
The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with an un-sandboxed Mono CLR interpreter.
Products: mono_project mono, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | mono | 5.18.0.240+dfsg-3+deb10u1 |
| Debian 12 | mono | 6.8.0.105+dfsg-3.3 |
| Debian 13 | mono | 6.8.0.105+dfsg-3.3 |
| Debian 14 | mono | 6.8.0.105+dfsg-3.3 |
| Ubuntu 14.04 LTS | mono | no fix |
| Ubuntu 16.04 LTS | mono | no fix |
| Ubuntu 18.04 LTS | mono | no fix |
| Ubuntu 20.04 LTS | mono | no fix |
| Ubuntu 22.04 LTS | mono | no fix |