PT-2010-5452 · Realnetworks+1 · Linux Realplayer+4
Published
2010-12-10
·
Updated
2011-01-26
·
CVE-2010-4375
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
RealPlayer versions 11.0 through 11.1
Mac RealPlayer versions 11.0 through 11.1
Linux RealPlayer version 11.0.2.1744
HelixPlayer version 1.0.6
Description
The issue allows remote attackers to execute arbitrary code via malformed multi-rate data in an audio stream. This is a result of a heap-based buffer overflow.
Recommendations
For RealPlayer versions 11.0 through 11.1, update to a version that is not affected by this issue.
For Mac RealPlayer versions 11.0 through 11.1, update to a version that is not affected by this issue.
For Linux RealPlayer version 11.0.2.1744, update to a version that is not affected by this issue.
For HelixPlayer version 1.0.6, update to a version that is not affected by this issue.
As a temporary workaround, consider disabling the handling of multi-rate audio streams until a patch is available.
Fix
RCE
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Helix Player
Linux Realplayer
Mac Realplayer
Realplayer
Red Hat