PT-2007-6018 · Realnetworks · Realplayer+1

Published 2007-09-17 · Updated 2018-10-15 · CVE-2007-4904

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: RealPlayer version 10.1.0.3114 and earlier Helix Player version 1.0.6.778

Description: The issue allows user-assisted remote attackers to cause a denial of service, resulting in an application crash. This is achieved by providing a malformed .au file that triggers a divide-by-zero error.

Recommendations: For RealPlayer version 10.1.0.3114 and earlier, avoid opening malformed .au files to prevent the application crash. For Helix Player version 1.0.6.778, refrain from processing untrusted .au files until a fix is available. As a temporary workaround, consider disabling the processing of .au files in both RealPlayer and Helix Player until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2007-4904

Affected Products

Helix Player

Realplayer

References · 7

• 🔥 https://exploit-db.com/exploits/4683 · Exploit
• 🔥 http://securityfocus.com/bid/25627 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4904 · Security Note
• http://securityfocus.com/archive/1/479081/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36545 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-09/0154.html · Note
• http://osvdb.org/39904 · Note