PT-2010-1336 · Realnetworks · Realplayer+1
Peter Vreugdenhil
·
Publicado
2010-01-21
·
Atualizado
2018-10-10
·
CVE-2009-4246
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
RealPlayer versions 6.0.12.1040 through 6.0.12.1741
RealPlayer versions 11.0.0 through 11.0.4
RealPlayer Enterprise (affected versions not specified)
Mac RealPlayer versions 10 and 10.1
Linux RealPlayer version 10
Helix Player versions 10.x
Description
The issue is a stack-based buffer overflow that allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file. This file contains a web.xmb file with crafted length values.
Recommendations
For RealPlayer versions 6.0.12.1040 through 6.0.12.1741, update to a version outside of this range to resolve the issue.
For RealPlayer versions 11.0.0 through 11.0.4, update to a version later than 11.0.4 to resolve the issue.
For RealPlayer Enterprise, Mac RealPlayer versions 10 and 10.1, Linux RealPlayer version 10, and Helix Player versions 10.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Helix Player
Realplayer