PT-2010-1339 · Realnetworks+1 · Helix Player+5
Tomas Hoger
·
Publicado
2010-01-21
·
Atualizado
2018-10-10
·
CVE-2009-4257
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
RealPlayer versions 10 through 11.0.4
RealPlayer 10.5 versions 6.0.12.1040 through 6.0.12.1741
RealPlayer Enterprise (affected versions not specified)
Mac RealPlayer versions 10 and 10.1
Linux RealPlayer versions 10 and 11.0.0
Helix Player versions 10.x and 11.0.0
Description
The issue is a heap-based buffer overflow in the smlrender.dll component, allowing remote attackers to execute arbitrary code via an SMIL file with crafted string lengths. This can be exploited by providing a specially crafted SMIL file.
Recommendations
For RealPlayer versions 10 through 11.0.4, update to a version outside of the affected range.
For RealPlayer 10.5 versions 6.0.12.1040 through 6.0.12.1741, update to a version outside of the affected range.
For RealPlayer Enterprise, Mac RealPlayer versions 10 and 10.1, Linux RealPlayer versions 10 and 11.0.0, and Helix Player versions 10.x and 11.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Helix Player
Linux Realplayer
Mac Realplayer
Realplayer
Realplayer Enterprise
Red Hat