CVE-2010-4391

RealNetworks RealPlayer vulnerability CVE-2010-4391 affects RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, and RealPlayer Enterprise 2.1.2–2.1.3. The issue is a heap-based buffer overflow caused by parsing a header field in RMX files, leading to remote code execution. Public writeups describe the...

CVE-2010-4392

CVE-2010-4392 is a heap-based buffer overflow in RealPlayer/HelixPlayer family that allows remote code execution via crafted ImageMap data in RealMedia files. Affected: RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, RealPlayer Enterprise 2.1.2–2.1.3, Linux RealPlayer 11.0.2.1744, possibly HelixPl...

CVE-2010-4394

RealPlayer vulnerability CVE-2010-4394 affects RealNetworks RealPlayer 11.0–11.1 and RealPlayer SP 1.0–1.1.5. The issue is a heap-based buffer overflow in RealPlayer’s parsing of a Server header within a RealPix-related HTTP response, allowing remote code execution. The disclosed advisory (ZDI-10...

CVE-2010-4385

CVE-2010-4385 is part of a set of vulnerabilities affecting RealPlayer/HelixPlayer (RealPlayer 11.x, RealPlayer SP, HelixPlayer) with multiple flaws in the RealPlayer/HelixPlayer codebase. The initial entry notes an integer overflow vulnerability triggered by crafted SIPR frame dimensions, enabli...

CVE-2010-4378

CVE-2010-4378 affects RealPlayer/HelixPlayer family. The drv2.dll RV20 decompression component can be triggered by a crafted RV20 video stream length field, leading to remote arbitrary code execution or heap memory corruption. Affected products include RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1....

CVE-2010-4384

CVE-2010-4384 is an array index error in RealPlayer (versions 11.0–11.1, RealPlayer Enterprise 2.1.2, Mac and Linux RealPlayer 11.0.2.1744; possibly HelixPlayer 1.0.6) that enables remote code execution via a malformed RealMedia MDPR header. Connected sources indicate RealPlayer/HelixPlayer flaws...

CVE-2010-4391

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allows remote attackers to execute arbitrary code via a crafted value in an unspecified header field in an RMX file...

CVE-2010-4396

Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying ...

CVE-2010-4376

CVE-2010-4376 describes a heap-based buffer overflow in RealNetworks RealPlayer 11.x (Windows, Mac, Linux) and RealPlayer SP 1.x, triggered by a large Screen Width value in the GIF87a Screen Descriptor of an RTSP stream. This allows remote code execution. Public sources in the provided documents ...

CVE-2010-4395

RealNetworks RealPlayer contains a heap-based buffer overflow in the AAC decoding path that affects RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, and Linux RealPlayer 11.0.2.1744, allowing remote code execution via a crafted conditional component in AAC frame data. The related OpenVAS/NVD entrie...

CVE-2010-2579

The CVE-2010-2579 issue affects RealNetworks RealPlayer family (RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, Enterprise 2.1.2, Mac 11.x, Linux 11.0.2.1744). The root cause is a failure to properly initialize the Cook codec’s channel count, leading to use of uninitialized memory and memory acces...

CVE-2010-4381

CVE-2010-4381 describes a heap-based buffer overflow in RealNetworks RealPlayer products (RealPlayer 11.x, RealPlayer SP, RealPlayer Enterprise, and Mac RealPlayer up to 12.0.0.1444) that is triggered by a crafted AAC file. The vulnerability permits remote attackers to achieve unspecified impact....

CVE-2010-2997

CVE-2010-2997 is tied to multiple advisories (RHSA-2010:0981, CESA-2010:0981) and OpenVAS/Nessus entries describing multiple security flaws in RealPlayer/HelixPlayer, potentially enabling arbitrary code execution via crafted media/stream content. Remediation across affected platforms centers on r...

iDefense Security Advisory 12.10.10: RealNetworks RealPlayer RealAudio Codec Memory Corruption Vulnerability

iDefense Security Advisory 12.10.10 http://labs.idefense.com/intelligence/vulnerabilities/ Dec 10, 2010 I. BACKGROUND RealPlayer is RealNetworks's media player product used to render video and other media. For more information, visit http://www.real.com/. II. DESCRIPTION Remote exploitation of a...

CVE-2010-2999: Undefined Security Weakness

Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a malformed MLLT atom in an...

CVE-2010-4384: Improper Input Validation

Array index error in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via a malformed Media Properties Header...

CVE-2010-0121: Undefined Security Weakness

The cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 does not properly perform initialization, which has unspecified impact and attack vectors...

CVE-2010-4391: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allows remote attackers to execute arbitrary code via a crafted value in an unspecified header field in an RMX file...

CVE-2010-4394: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.5 allows remote web servers to execute arbitrary code via a long Server header in a response to an HTTP request that occurs during parsing of a RealPix file...

CVE-2010-4392: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.1.2 and 2.1.3, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via crafted ImageMap...