PT-2010-1932 · Realnetworks · Realplayer+1

Publicado 2010-08-30 · Atualizado 2017-09-19 · CVE-2010-0116

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.1.4

Description The issue is related to an integer overflow that might allow remote attackers to execute arbitrary code via a crafted QCP file, triggering a heap-based buffer overflow.

Recommendations For RealPlayer versions 11.0 through 11.1, update to a version that fixes the integer overflow issue. For RealPlayer SP versions 1.0 through 1.1.4, update to a version that fixes the integer overflow issue. As a temporary workaround, consider avoiding the use of QCP files until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2010-0116

Produtos afetados

Realplayer

Realplayer Sp

Referências · 11

• http://secunia.com/advisories/41096 · Nota
• http://service.real.com/realplayer/security/08262010_player/en · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7326 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0116 · Nota de Segurança
• http://secunia.com/advisories/41154 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61420 · Nota
• http://vupen.com/english/advisories/2010/2216 · Nota
• http://securitytracker.com/id?1024370 · Nota
• http://secunia.com/secunia_research/2010-3 · Aviso do Fabricante
• http://xforce.iss.net/xforce/xfdb/61420 · Nota
• http://service.real.com/realplayer/security/10152010_player/en · Nota