Description
Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to trigger a buffer overflow and modify internal data structures, and cause a denial of service (plugin crash) or corrupt the internal state of the security manager, via a crafted media file in which a thread makes a change after a type check but before a copy action.
References (10)
Core 10
Core References
Patch x_refsource_confirm
https://bugzilla.novell.com/show_bug.cgi?id=667077
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/47208
Patch mailing-list
x_refsource_mlist
http://openwall.com/lists/oss-security/2011/04/06/14
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/44002
Various Sources x_refsource_confirm
http://www.mono-project.com/Vulnerabilities
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/44076
Patch x_refsource_confirm
https://github.com/mono/mono/commit/2f00e4bbb2137130845afb1b2a1e678552fc8e5c
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66625
Mailing List mailing-list
x_refsource_mlist
http://lists.opensuse.org/opensuse-updates/2011-04/msg00024.html
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0904
Scores
EPSS
0.0117
EPSS Percentile
78.9%
Details
CWE
CWE-362
Status
published
Products (7)
mono/mono
novell/moonlight
2.0
novell/moonlight
2.3.0
novell/moonlight
2.4
novell/moonlight
2.31
novell/moonlight
3.0
novell/moonlight
3.99
Published
Apr 13, 2011
Tracked Since
Feb 18, 2026