PT-2010-4469 · Realnetworks · Realplayer

Published 2010-08-26 · Updated 2018-10-10 · CVE-2010-2996

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1

Description The issue is related to an array index error that allows remote attackers to execute arbitrary code via a malformed header in a RealMedia .IVR file. This is a code execution issue.

Recommendations For versions 11.0 through 11.1, update to a version that contains a fix for this issue to prevent arbitrary code execution.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-2996

ZDI-10-166

Affected Products

Realplayer

References · 12

• http://service.real.com/realplayer/security/08262010_player/en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2996 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-10-166 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6703 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61425 · Note
• http://zerodayinitiative.com/advisories/ZDI-10-166 · Note
• http://service.real.com/realplayer/security/10152010_player/en · Note
• http://vupen.com/english/advisories/2010/2216 · Note
• http://secunia.com/advisories/41154 · Note
• http://securitytracker.com/id?1024370 · Note
• http://securityfocus.com/archive/1/513381/100/0/threaded · Note
• http://xforce.iss.net/xforce/xfdb/61425 · Note