CVE catalog

CVE-2023-26314

mono: CVE-2023-26314

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.97% · Oct 25, 2026

The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with an un-sandboxed Mono CLR interpreter.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmonosid6.14.1+ds2-3fixed
Debianmonoforky6.14.1+ds2-3fixed
Debianmonotrixie6.12.0.199+dfsg-6fixed
Debianmonobookworm6.8.0.105+dfsg-3.3+deb12u1fixed
Ubuntumono14.042.10.8.1-5ubuntu2vulnerable
Ubuntumono14.043.2.3+dfsg-5vulnerable
Ubuntumono14.043.2.3+dfsg-7ubuntu1vulnerable
Ubuntumono14.043.2.8+dfsg-4ubuntu1vulnerable
Ubuntumono14.043.2.8+dfsg-4ubuntu1.1vulnerable
Ubuntumono16.043.2.8+dfsg-4ubuntu4vulnerable
Ubuntumono16.044.2.1.102+dfsg2-5ubuntu1vulnerable
Ubuntumono16.044.2.1.102+dfsg2-7ubuntu4vulnerable
Ubuntumono18.044.6.2.7+dfsg-1ubuntu1vulnerable
Ubuntumono20.045.18.0.240+dfsg-3vulnerable
Ubuntumono20.046.8.0.105+dfsg-1vulnerable
Ubuntumono20.046.8.0.105+dfsg-2vulnerable
Ubuntumono22.046.8.0.105+dfsg-3.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmonosourcesid6.8.0.105+dfsg-3.3not yet assignedNot reported[972146]
Debianmonosourceforky6.8.0.105+dfsg-3.3not yet assignedNot reported[972146]
Debianmonosourcetrixie6.8.0.105+dfsg-3.3not yet assignedNot reported[972146]
Debianmonosourcebookworm6.8.0.105+dfsg-3.3not yet assignedNot reported[972146]

[Debian bug #972146]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]