CVE-2011-2954

Use-after-free vulnerability in the AutoUpdate feature in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2011-2949

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via crafted ID3v2 tags in an MP3 file...

CVE-2011-2951

CVE-2011-2951 describes a buffer overflow in RealNetworks RealPlayer affecting multiple versions (RealPlayer 11.0–11.1, 14.0.0–14.0.5; RealPlayer SP 1.0–1.1.5; Mac RealPlayer 12.0.0.1569) that can allow remote code execution via a crafted raw_data_frame field in an AAC file. Root cause: improper ...

CVE-2011-2951

Buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer 12.0.0.1569 allows remote attackers to execute arbitrary code via a crafted rawdataframe field in an AAC file...

CVE-2011-2947

Cross-zone scripting vulnerability in the RealPlayer ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to inject arbitrary web script or HTML in the Local Zone via a local HTML document...

CVE-2011-2955

CVE-2011-2955 is a use-after-free vulnerability in RealNetworks RealPlayer when using an Embedded RealPlayer, allowing remote code execution via vectors related to a modal dialog. Affected products include RealPlayer 11.0–11.1, 14.0.0–14.0.5 (and RealPlayer SP 1.0–1.1.5, RealPlayer Enterprise 2.0...

CVE-2011-2945

RealPlayer (Windows) is affected by CVE-2011-2945 due to a heap-based buffer overflow in SIPR within RealPlayer 11.0–11.1 and 14.0.0–14.0.5. This allows remote code execution via a crafted SIPR stream. Public sources confirm the vulnerability and CVE mapping, but none of the connected documents p...

CVE-2011-2952

RealPlayer family (RealPlayer 11.0–11.1, 14.0.0–14.0.5; RealPlayer SP 1.0–1.1.5; RealPlayer Enterprise 2.0–2.1.5) is affected by a use-after-free in dialog box handling that allows remote code execution. This is CVE-2011-2952. The vulnerability is triggered via dialog-box-related vectors and can ...

CVE-2011-2947

CVE-2011-2947 relates to a cross-zone scripting vulnerability in the RealPlayer ActiveX control. Affected products include RealPlayer 11.0–11.1 and 14.0.0–14.0.5, as well as RealPlayer SP 1.0–1.1.5 (per the description). The flaw allows remote attackers to inject arbitrary web script or HTML into...

CVE-2011-2950

Heap-based buffer overflow in qcpfformat.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted QCP file...

CVE-2011-2948

RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.0 through 2.1.5, and Mac RealPlayer 12.0.0.1569 do not properly handle DEFINEFONT fields in SWF files, which allows remote attackers to execute arbitrary code or cause a...

CVE-2011-2955

Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via vectors related to a modal...

RealNetworks Realplayer multiple security vulnerabilities

QCP, AAC, MP3, SWF, SIPR parsing memory corruptions, crossite scripting, unsafe methods and buffer overflow in ActiveX...

ZDI-11-265: RealNetworks Realplayer QCP Parsing Remote Code Execution Vulnerability

ZDI-11-265: RealNetworks Realplayer QCP Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-265 August 16, 2011 -- CVE ID: CVE-2011-2950 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: RealNetworks -- Affected Products: RealNetworks RealPlaye...

RealNetworks Realplayer QCP Parsing Heap Overflow

This module exploits a heap overflow in Realplayer when handling a .QCP file. The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is allocated on the heap and user-supplied data from the file is copied within a memory copy loop. This allows a remote attacker to execute...

RealPlayer 12.0.1.660 Stack Hash/Crash POC

Exploit for windows platform in category dos / poc =========================================== RealPlayer 12.0.1.660 Stack Hash/Crash POC =========================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ ...

RealNetworks RealPlayer SWF DefineFont Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way...

RealNetworks Realplayer MP3 ID3 tags Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks Realplayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way...

RealNetworks Realplayer QCP Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

RealNetworks RealPlayer Cross-Zone Scripting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists due to the fact...