PT-2010-1333 · Realnetworks · Realplayer+1

Published 2010-01-25 · Updated 2017-08-17 · CVE-2009-4243

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 10, 10.5 6.0.12.1040 through 6.0.12.1741 RealPlayer version 11 11.0.0 through 11.0.4 RealPlayer Enterprise Mac RealPlayer versions 10 and 10.1 Linux RealPlayer version 10 Helix Player versions 10.x

Description The issue allows remote attackers to have an unspecified impact via a crafted media file that uses HTTP chunked transfer coding, related to an "overflow."

Recommendations For RealPlayer versions 10, 10.5 6.0.12.1040 through 6.0.12.1741, update to a version outside of the affected range. For RealPlayer version 11 11.0.0 through 11.0.4, update to a version outside of the affected range. For RealPlayer Enterprise, update to a version that is not affected by the issue. For Mac RealPlayer versions 10 and 10.1, update to a version outside of the affected range. For Linux RealPlayer version 10, update to a version that is not affected by the issue. For Helix Player versions 10.x, update to a version outside of the affected range.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-4243

Affected Products

Helix Player

Realplayer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2009-4243 · Security Note
• http://secunia.com/advisories/38218 · Vendor Advisory
• http://vupen.com/english/advisories/2010/0178 · Vendor Advisory
• http://securitytracker.com/id?1023489 · Patch
• http://service.real.com/realplayer/security/01192010_player/en · Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/55796 · Note
• http://osvdb.org/61967 · Note
• http://securityfocus.com/bid/37880 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55796 · Note