CVE-2011-0990

Race condition in the FastCopy optimization in the Array.Copy method in
metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before
3.99.3 is used, allows remote attackers to trigger a buffer overflow and
modify internal data structures, and cause a denial of service (plugin
crash) or corrupt the internal state of the security manager, via a crafted
media file in which a thread makes a change after a type check but before a
copy action.

Bugs

• <https://bugzilla.novell.com/show_bug.cgi?id=667077&gt;

Notes