PT-2010-1932 · Realnetworks · Realplayer+1

Published 2010-08-30 · Updated 2017-09-19 · CVE-2010-0116

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.1.4

Description The issue is related to an integer overflow that might allow remote attackers to execute arbitrary code via a crafted QCP file, triggering a heap-based buffer overflow.

Recommendations For RealPlayer versions 11.0 through 11.1, update to a version that fixes the integer overflow issue. For RealPlayer SP versions 1.0 through 1.1.4, update to a version that fixes the integer overflow issue. As a temporary workaround, consider avoiding the use of QCP files until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-0116

Affected Products

Realplayer

Realplayer Sp

References · 11

• http://service.real.com/realplayer/security/08262010_player/en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0116 · Security Note
• http://secunia.com/secunia_research/2010-3 · Vendor Advisory
• http://secunia.com/advisories/41096 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7326 · Note
• http://secunia.com/advisories/41154 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61420 · Note
• http://vupen.com/english/advisories/2010/2216 · Note
• http://securitytracker.com/id?1024370 · Note
• http://xforce.iss.net/xforce/xfdb/61420 · Note
• http://service.real.com/realplayer/security/10152010_player/en · Note