Unrated severityNVD Advisory· Published Apr 13, 2011· Updated Apr 29, 2026
CVE-2011-0992
CVE-2011-0992
Description
Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain sensitive information via vectors related to member data in a resurrected MonoThread instance.
Affected products
7cpe:2.3:a:novell:moonlight:2.0:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:novell:moonlight:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:novell:moonlight:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:novell:moonlight:2.4:*:*:*:*:*:*:*
- cpe:2.3:a:novell:moonlight:2.31:*:*:*:*:*:*:*
- cpe:2.3:a:novell:moonlight:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:novell:moonlight:3.99:*:*:*:*:*:*:*
Patches
1722f9890f09aFix access to freed members of a dead thread
1 file changed · +8 −3
mono/metadata/threads.c+8 −3 modified@@ -1036,12 +1036,17 @@ void ves_icall_System_Threading_InternalThread_Thread_free_internal (MonoInterna CloseHandle (thread); if (this->synch_cs) { - DeleteCriticalSection (this->synch_cs); - g_free (this->synch_cs); + CRITICAL_SECTION *synch_cs = this->synch_cs; this->synch_cs = NULL; + DeleteCriticalSection (synch_cs); + g_free (synch_cs); } - g_free (this->name); + if (this->name) { + void *name = this->name; + this->name = NULL; + g_free (name); + } } static void mono_thread_start (MonoThread *thread)
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
12- openwall.com/lists/oss-security/2011/04/06/14nvdPatch
- bugzilla.novell.com/show_bug.cginvdPatch
- bugzilla.redhat.com/show_bug.cginvdPatch
- github.com/mono/mono/commit/722f9890f09aadfc37ae479e7d946d5fc5ef7b91nvdPatch
- secunia.com/advisories/44002nvdVendor Advisory
- secunia.com/advisories/44076nvdVendor Advisory
- www.mono-project.com/VulnerabilitiesnvdVendor Advisory
- www.vupen.com/english/advisories/2011/0904nvdVendor Advisory
- lists.opensuse.org/opensuse-updates/2011-04/msg00024.htmlnvd
- www.securityfocus.com/bid/47208nvd
- bugzilla.novell.com/show_bug.cginvd
- exchange.xforce.ibmcloud.com/vulnerabilities/66627nvd
News mentions
0No linked articles in our index yet.