PT-2010-5467 · Realnetworks · Linux Realplayer+2

Published 2010-12-14 · Updated 2011-01-19 · CVE-2010-4390

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.1.5 Linux RealPlayer version 11.0.2.1744

Description The issue is related to multiple heap-based buffer overflows that can be triggered by a crafted header in an IVR file, allowing remote attackers to have an unspecified impact.

Recommendations For RealPlayer versions 11.0 through 11.1, update to a version outside of this range to resolve the issue. For RealPlayer SP versions 1.0 through 1.1.5, update to a version outside of this range to resolve the issue. For Linux RealPlayer version 11.0.2.1744, update to a version newer than 11.0.2.1744 to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-4390

Affected Products

Linux Realplayer

Realplayer

Realplayer Sp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-4390 · Security Note
• http://service.real.com/realplayer/security/12102010_player/en · Vendor Advisory
• http://osvdb.org/69850 · Note
• http://securitytracker.com/id?1024861 · Note