PT-2010-1332 · Realnetworks+1 · Realplayer+2
Tomas Hoger
·
Publicado
2010-01-21
·
Atualizado
2018-10-10
·
CVE-2009-4242
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
RealPlayer versions 10 through 11.0.4
RealPlayer 10.5 versions 6.0.12.1040 through 6.0.12.1741
RealPlayer Enterprise (affected versions not specified)
Mac RealPlayer versions 10, 10.1, and 11.0
Linux RealPlayer version 10
Helix Player versions 10.x
Description
The issue is related to a heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function, which can be triggered by a GIF file with crafted chunk sizes, leading to improper memory allocation. This allows remote attackers to execute arbitrary code.
Recommendations
For RealPlayer versions 10 through 11.0.4, update to a version outside of the affected range.
For RealPlayer 10.5 versions 6.0.12.1040 through 6.0.12.1741, update to a version outside of the affected range.
For RealPlayer Enterprise, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For Mac RealPlayer versions 10, 10.1, and 11.0, update to a version outside of the affected range.
For Linux RealPlayer version 10, update to a version outside of the affected range.
For Helix Player versions 10.x, update to a version outside of the affected range.
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Helix Player
Realplayer
Red Hat