CVE-2010-3749

The CVE-2010-3749 flaw affects RealNetworks RealPlayer 11.0–11.1 and RealPlayer SP 1.0–1.1, in the browser-plugin/ActiveX implementation for the RecordClip method. A specific argument containing a double-quote enables parameter injection that allows remote code execution: an attacker can craft a ...

CVE-2010-3749

The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to arguments to the RecordClip method, which allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via a "...

CVE-2010-2578

CVE-2010-2578 is a heap-based buffer overflow in RealNetworks RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer Enterprise 2.1.2 that can be exploited by a crafted QCP file to cause an unspecified impact. Multiple connected sources corroborate the vulnerability, including CVE records ...

CVE-2010-3748

CVE-2010-3748 covers a stack-based buffer overflow in RealNetworks RealPlayer’s RichFX component. Affected products include RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer Enterprise 2.1.2. The core issue is a RichFX overflow that could allow remote code execution; Microsoft MSVR ad...

CVE-2010-2998

Array index error in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.0.1 allows remote attackers to execute arbitrary code via malformed sample data in a RealMedia .IVR file, related to a "malformed IVR pointer index" issue...

CVE-2010-3751

CVE-2010-3751 concerns multiple heap-based buffer overflows in the RealPlayer ActiveX control. The vulnerability arises when processing a long ".smil" argument in the tfile, pnmm, or cdda protocol handlers, allowing remote attackers to execute arbitrary code. Affected software includes RealPlayer...

CVE-2010-3750

rjrmrpln.dll in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly validate file contents that are used during interaction with a heap buffer, which allows remote attackers to execute arbitrary code via crafted Name Value...

CVE-2010-2998

CVE-2010-2998 : RealNetworks RealPlayer (Windows) is affected by an array index error in parsing RealMedia IVR data, leading to remote code execution. Impact: arbitrary code could be run in the context of the logged-in user when a vulnerable RealPlayer instance processes a malformed IVR file. Aff...

CVE-2010-3751

Multiple heap-based buffer overflows in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 allow remote attackers to execute arbitrary code via a long .smil argument to the 1 tfile, 2 pnmm, or 3 cdda protocol handler...

CVE-2010-3750

This CVE (CVE-2010-3750) affects RealNetworks RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer Enterprise 2.1.2. The issue is a heap-buffer interaction flaw in rjrmrpln.dll where file contents are not properly validated during parsing of Name Value Property (NVP) elements in logical ...

PT-2010-5039

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.1.4 RealPlayer Enterprise version 2.1.2 Description A stack-based buffer overflow issue exists in the RichFX component. This issue may allow remote attackers to have an...

CVE-2010-3750: Improper Input Validation

rjrmrpln.dll in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly validate file contents that are used during interaction with a heap buffer, which allows remote attackers to execute arbitrary code via crafted Name Value...

PT-2010-4123

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.1.4 RealPlayer Enterprise version 2.1.2 Description A heap-based buffer overflow issue exists, allowing remote attackers to have an unspecified impact via a crafted QCP...

RealNetworks Releases Security Update for RealPlayer Vulnerabilities

RealNetworks has issued a Security Update to address multiple vulnerabilities affecting RealPlayer. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the RealNetworks security advisory and apply any necessa...

CVE-2010-3748: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the RichFX component in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 allows remote attackers to have an unspecified impact via unknown vectors...

CVE-2010-2578: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 allows remote attackers to have an unspecified impact via a crafted QCP file...

CVE-2010-3751: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 allow remote attackers to execute arbitrary code via a long .smil argument to the 1 tfile, 2 pnmm, or 3 cdda protocol handler...

CVE-2010-3747: Improper Restriction of Operations within the Bounds of a Memory Buffer

An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI, which allows remote attackers to execute arbitrary code or cause a denial of...

CVE-2010-3749: Improper Control of Generation of Code

The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to arguments to the RecordClip method, which allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via a "...

CVE-2010-2998: Improper Input Validation

Array index error in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.0.1 allows remote attackers to execute arbitrary code via malformed sample data in a RealMedia .IVR file, related to a "malformed IVR pointer index" issue...