PT-2010-5452 · Realnetworks+1 · Linux Realplayer+4

Publicado

2010-12-10

·

Atualizado

2011-01-26

·

CVE-2010-4375

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 Mac RealPlayer versions 11.0 through 11.1 Linux RealPlayer version 11.0.2.1744 HelixPlayer version 1.0.6
Description The issue allows remote attackers to execute arbitrary code via malformed multi-rate data in an audio stream. This is a result of a heap-based buffer overflow.
Recommendations For RealPlayer versions 11.0 through 11.1, update to a version that is not affected by this issue. For Mac RealPlayer versions 11.0 through 11.1, update to a version that is not affected by this issue. For Linux RealPlayer version 11.0.2.1744, update to a version that is not affected by this issue. For HelixPlayer version 1.0.6, update to a version that is not affected by this issue. As a temporary workaround, consider disabling the handling of multi-rate audio streams until a patch is available.

Correção

RCE

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-4375
RHSA-2010:0981
RHSA-2010_0981
ZDI-10-266

Produtos afetados

Helix Player
Linux Realplayer
Mac Realplayer
Realplayer
Red Hat