Jeroen Frijters

**Name of the Vulnerable Software and Affected Versions** Microsoft .NET Framework versions 2.0 SP2, 3.5.1, and 4 Silverlight versions 4 through 4.1.10110 **Description** A remote code execution issue exists due to improper restriction of access to memory associated with unmanaged objects. This allows remote attackers to execute arbitrary code via crafted applications, including XAML browser applications, ASP.NET applications, .NET Framework applications, or Silverlight applications. An attacker who successfully exploits this issue could run arbitrary code in the security context of the logged-on user, potentially installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights. **Recommendations** For Microsoft .NET Framework versions 2.0 SP2, 3.5.1, and 4, update to a version that includes the fix for this issue. For Silverlight versions 4 through 4.1.10110, update to version 4.1.10111 or later. As a temporary workaround, consider restricting access to crafted applications that could exploit this issue until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mono versions prior to 2.4.1 or 3.99.3 **Description** The issue is related to a race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono. This can be triggered by remote attackers via a crafted media file, allowing them to cause a denial of service (plugin crash) or corrupt the internal state of the security manager by modifying internal data structures. **Recommendations** For Mono versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. For Mono versions prior to 3.99.3, update to version 3.99.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft .NET Framework version 4.0 **Description** A remote code execution issue exists in the Microsoft .NET Framework, specifically affecting the x64 and Itanium architectures. This is due to improper optimizations by the JIT compiler, allowing remote attackers to execute arbitrary code via a crafted .NET application that triggers memory corruption. The issue enables a specially crafted Microsoft .NET application to access memory in an unsafe manner, leading to arbitrary unmanaged code execution. **Recommendations** For Microsoft .NET Framework version 4.0, update to a version that includes the fix for this issue to prevent arbitrary code execution.

**Name of the Vulnerable Software and Affected Versions** Microsoft .NET Framework versions 2.0 through 3.5 **Description** A remote code execution issue exists due to the improper enforcement of a type-equality constraint in .NET verifiable code. This allows remote attackers to execute arbitrary code via crafted applications, including XAML browser applications (XBAP), ASP.NET applications, or .NET Framework applications. The issue can be exploited by a malicious Microsoft .NET application bypassing a type equality check, leading to arbitrary unmanaged code execution by casting an object of one type into another type. **Recommendations** For Microsoft .NET Framework versions 2.0 through 3.5, update to a version that properly enforces type-equality constraints to prevent arbitrary code execution.