CVE-2010-3747

CVE-2010-3747 affects RealNetworks RealPlayer ActiveX control; the vulnerability stems from uninitialized memory during parsing of CDDA URIs, allowing remote code execution or denial of service via a long URI. Affected products include RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer...

CVE-2012-5691

CVE-2012-5691 is a buffer overflow in RealNetworks RealPlayer prior to 16.0.0.282 and RealPlayer SP 1.0–1.1.5 that allows remote code execution via a crafted RealMedia file. Connected advisories and exploits confirm real-world discussion and tooling around RealPlayer RealMedia file handling BOF (...

CVE-2009-4245

CVE-2009-4245 is a heap-based buffer overflow in RealNetworks RealPlayer/HelixPlayer GIF processing (gifcodec.cpp/gifimage.cpp). Affected products include RealPlayer 10, 10.5 (6.0.12.1040–1741), RealPlayer 11 (11.0.0–11.0.4), RealPlayer Enterprise, Mac/Linux RealPlayer 10/10.1, and Helix Player 1...

CVE-2005-2936

CVE-2005-2936 is an unquoted Windows search path vulnerability in RealNetworks RealPlayer 10.5 and RealPlayer 10/RealOne Player lines (versions 6.0.12.1040–6.0.12.1348; Pre-20060322 RealPlayer 8; RealOne Player v1/v2), which could allow a local user to gain privileges by placing a malicious C:\pr...

CVE-2022-32291

CVE-2022-32291 affects RealPlayer up to version 20.1.0.312. An attacker can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file, triggering code execution on affected systems. Multiple sources (NVD entry) corroborate the impact and condition. The connected docume...

CVE-2004-1094

CVE-2004-1094 concerns a buffer overflow in InnerMedia DynaZip DUNZIP32.dll (version 5.00.03 and earlier) that enables remote code execution when a crafted ZIP with a long filename is processed. Affected products include RealPlayer 10 / RealOne Player and various third‑party apps (e.g., CheckMark...

CVE-2009-4257

CVE-2009-4257 is a heap-based buffer overflow in SMIL handling within HelixPlayer/RealPlayer (smlrender.dll/smlpkt.cpp) that could allow remote code execution when processing crafted SMIL data. Public advisories (Red Hat RHSA-2010-0094, CentOS/SuSE/Oracle Linux updates, OpenVAS/NASL entries) docu...

CVE-2005-1766

CVE-2005-1766 describes a heap-based buffer overflow in RealPlayer’s RealText parser (RealText/SMIL handling) that can be triggered by a specially crafted RealMedia file containing a long RealText string. Exploitation could allow remote code execution with the privileges of the logged-in user. Af...

CVE-2005-2629

CVE-2005-2629 describes an integer/stack-based overflow in RealNetworks RealPlayer (versions 8, 10, 10.5), RealOne Player (1–2), and Helix Player 10.0.0 that can be triggered by a malformed .rm file with a large length field in the first data packet, allowing remote code execution. The vulnerabil...

CVE-2010-4378

CVE-2010-4378 affects RealPlayer/HelixPlayer family. The drv2.dll RV20 decompression component can be triggered by a crafted RV20 video stream length field, leading to remote arbitrary code execution or heap memory corruption. Affected products include RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1....

CVE-2005-0755

CVE-2005-0755 describes a heap-based buffer overflow in RealPlayer 10 and earlier, Helix Player prior to 10.0.4, and RealOne Player v1/v2. The flaw allows remote attackers to execute arbitrary code by sending a long hostname in a RAM file, enabling code execution and potential control of the affe...

CVE-2022-32270

CVE-2022-32270 affects RealNetworks RealPlayer versions 20.0.7.309 and 20.0.8.310. The flaw arises in external::Import(), which permits downloading arbitrary file types and directory traversal, enabling remote code execution. Root cause is facilitate­ment of DLL planting or executables in the sta...

CVE-2007-4599

Mode C: CVE-2007-4599 affects RealNetworks RealPlayer 10 (and possibly 10.5) and RealOne Player 1/2 on Windows. Root cause is a stack-based buffer overflow during parsing of crafted .pls playlists, enabling remote code execution. Exploitation requires a user to process the malicious playlist (per...

CVE-2009-4242

CVE-2009-4242 is a heap-based buffer overflow in the GIF handling path of HelixPlayer/RealPlayer (GIF codec) that can be triggered by a crafted GIF file. Public docs corroborate that multiple GIF-related heap/overflow flaws affected HelixPlayer/RealPlayer and could allow remote code execution (no...

CVE-2008-1309

The RealPlayer rmoc3260.dll ActiveX control in RealPlayer Enterprise/RealPlayer 10/10.5 and RealPlayer 11 (pre-builds) contains a heap-memory corruption flaw in the Console/Controls properties that enables arbitrary code execution or a browser crash after sending long strings, as described in CVE...

CVE-2009-4243

RealPlayer/Helix vulnerability CVE-2009-4243 stems from an integer/heap overflow in the handling of HTTP chunked transfer encoded media. Affects RealPlayer 10–11 (Windows, Mac, Linux) and Helix Player 10.x. Remote code execution could be possible as described by multiple advisories; exploitation ...

CVE-2022-32269

Real Player 20.0.8.310’s G2 Control allows injection of unsafe javascript: URIs into local HTTP error pages (displayed by the IE core), enabling arbitrary code execution. This is consistently described across CVE sources (NVD, RH Red Hat, CNNVD, PRION, etc.). A practical remediation noted in PT-2...

CVE-2022-32271

CVE-2022-32271 relates to RealNetworks Real Player 20.0.8.310, where a DCP:// URI (an internal protocol used to reference a file containing a URL) can be abused to inject script code to arbitrary domains and reference arbitrary local files, enabling remote arbitrary code execution. The CVSS estim...

CVE-2005-0189

RealPlayer vulnerability CVE-2005-0189 is a stack-based buffer overflow in the HandleAction function that can be triggered by a long ShowPreferences argument, allowing remote code execution. It affects RealPlayer 10.5 (6.0.12.1040) and earlier. Red Hat advisory RHSA-2005:299 and related Nessus pl...

CVE-2005-0611

RealNetworks RealPlayer/RealOne Player WAV parsing (LIST chunk) suffers a heap-based buffer overflow that can allow remote code execution via crafted WAV files. Affected: RealPlayer 10.5 (6.0.12.1056 and earlier), RealPlayer 10, 8, RealOne Player V2/V1. Some connected advisories note exploitation...

CVE-2005-2922

CVE-2005-2922 : Heap-based buffer overflow in RealNetworks’ embedded player (RealPlayer 10.x, RealOne Player, Helix Player) can be triggered by a malicious server delivering a chunked HTTP response with a chunk header length -1, a header shorter than sent data, or a missing header. This may crash...

CVE-2007-5400

CVE-2007-5400 is a heap-based buffer overflow in RealNetworks RealPlayer 10.x (SWF frame handling) that can allow remote code execution via crafted SWF files. Connected advisories confirm a design/error in Shockwave Flash handling within RealPlayer’s SWF module, with multiple vendors issuing patc...

CVE-2010-4376

CVE-2010-4376 describes a heap-based buffer overflow in RealNetworks RealPlayer 11.x (Windows, Mac, Linux) and RealPlayer SP 1.x, triggered by a large Screen Width value in the GIF87a Screen Descriptor of an RTSP stream. This allows remote code execution. Public sources in the provided documents ...

CVE-2010-4383

CVE-2010-4383 is among a set of flaws in RealPlayer/Helix Player (RealPlayer 11.x, SP, Enterprise, Mac/Linux RealPlayer; HelixPlayer) that share a common codebase. The connected documents confirm multiple security flaws could be triggered by opening or playing malicious media files/streams, poten...

CVE-2013-7260

RealPlayer vulnerable: CVE-2013-7260 is a stack-based buffer overflow in RealPlayer before 17.0.4.61 (Windows) and before 12.0.1.1738 (Mac), triggered by a crafted .RMP file where a long value in the XML declaration’s version or encoding attributes causes arbitrary code execution. Exploitation ve...

CVE-2004-1481

The CVE-2004-1481 entry describes a heap-based buffer overflow in RealNetworks RealPlayer 8–10.5 (6.0.12.1040) and RealOne Player 1–2 on Windows or macOS, caused by an integer/length field overflow in pnen3260.dll when processing SMIL/.rm files with a very large length value for the data chunk. T...

CVE-2007-3410

CVE-2007-3410 describes a stack-based buffer overflow in RealPlayer/HelixPlayer when parsing SMIL wallclock values in SmilTimeValue::parseWallClockValue. This allows remote attackers to execute arbitrary code by feeding a crafted SMIL file with a long wallclock value. The issue affects RealPlayer...

CVE-2009-4246

CVE-2009-4246 is a RealPlayer/Helix vulnerability: a stack-based buffer overflow in RealPlayer 10/10.5, RealPlayer 11, RealPlayer Enterprise, Mac/Linux RealPlayer 10/10.1, and Helix Player 10.x could allow user-assisted remote code execution via a malformed .RJS skin file containing a crafted web...

CVE-2009-4248

CVE-2009-4248 describes a buffer overflow in RealPlayer/HelixPlayer’s RTSP SET_PARAMETER handling (RTSPProtocol::HandleSetParameterRequest). A crafted RTSP SET_PARAMETER request could crash the application or potentially allow arbitrary code execution. Affected products include RealPlayer 10/10.5...

CVE-2010-4393

RealNetworks RealPlayer vulnerability CVE-2010-4393 involves a heap-based buffer overflow in vidplin.dll when parsing AVI headers. Affected products include RealPlayer 11.0–11.1 and 14.0.x before 14.0.2, and RealPlayer SP 1.0–1.1.5. The issue permits remote code execution via a crafted AVI header...

CVE-2012-5690

CVE-2012-5690 affects RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0–1.1.5. The root cause is a flaw in processing RealAudio data that can trigger access to an invalid pointer, allowing remote code execution. The vulnerability is exploitable by a crafted RealAudio file sent over ...

CVE-2004-0258

CVE-2004-0258 affects RealNetworks RealPlayer family (RealOne Player, RealOne Player 2.0, RealOne Enterprise Desktop, RealPlayer Enterprise). The issue is multiple buffer overflows caused by improper handling of certain metafiles and streaming-image files, allowing remote attackers to execute arb...

CVE-2005-2055

Affected software : RealPlayer 8, RealPlayer 10, RealPlayer 10.5 (6.0.12.1040–1069), and RealPlayer Enterprise/RealOne Player v1 and v2. Issue : A vulnerability in how RealPlayer handles clip-encoded URLs could allow a remote attacker hosting a malicious web server to cause the player to generate...

CVE-2007-2263

CVE-2007-2263 describes a heap-based buffer overflow in RealNetworks RealPlayer/RealOne/HelixPlayer when processing SWF files with malformed record headers, allowing remote code execution. The underlying flaw is in how RealPlayer’s SWF parsing handles header records, enabling an attacker to craft...

CVE-2012-2406

RealPlayer and RealPlayer SP are affected by CVE-2012-2406 due to improper parsing of ASMRuleBook data in RealMedia files, enabling remote code execution via a crafted file. Affected products include RealNetworks RealPlayer before 15.0.4.53 and RealPlayer SP 1.0–1.1.5. The vulnerability enables a...

CVE-2002-1321

The CVE-2002-1321 entry concerns RealNetworks products RealOne and RealPlayer, where multiple buffer overflows can allow remote code execution. The root causes are: (1) a SMIL file with an excessively long parameter, (2) a long filename in an rtsp:// request (e.g., from a .m3u file), and (3) cert...

CVE-2005-2710

CVE-2005-2710 is a format string vulnerability in RealNetworks RealPlayer and HelixPlayer. The flaw affects processing of RealPix (.rp) and RealText (.rt) files and can allow a remote attacker to execute arbitrary code in the user’s context via crafted files. Public advisories (RHSA-2005-762/788,...

CVE-2007-5080

CVE-2007-5080 : Multiple RealNetworks RealPlayer family components (RealPlayer 10/10.5, RealOne Player 1, RealPlayer Enterprise) on Windows are affected by a heap-based buffer overflow triggered while processing Lyrics3 2.00 tags in MP3 files. The vulnerability would allow a remote attacker to ex...

CVE-2010-0416

CVE-2010-0416 : Buffer overflow in the Unescape function of Helix Player 1.0.6 and RealPlayer (hxurl.cpp, CHXClientSink.cpp) can be triggered by a URL containing a '%' not followed by two hex digits, causing denial of service or potentially arbitrary code execution. The issue stems from incorrect...

CVE-2011-4259

RealNetworks RealPlayer

CVE-2007-2264

The CVE-2007-2264 issue is a heap overflow in RealNetworks RealPlayer/RealOne/HelixPlayer when processing RA/RAM headers with an overly large size field. Affected products include RealPlayer 8, 10, 10.1 (and possibly 10.5), RealOne Player 1 and 2, and RealPlayer Enterprise. The underlying cause i...

CVE-2009-0375

CVE-2009-0375 corresponds to a remote code execution vulnerability in RealNetworks RealPlayer involving IVR file handling. The issue arises from incorrect handling of a filename length field in an IVR file, which can trigger a memory overwrite with a 0x00 byte, enabling arbitrary code execution. ...

CVE-2010-2578

CVE-2010-2578 is a heap-based buffer overflow in RealNetworks RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer Enterprise 2.1.2 that can be exploited by a crafted QCP file to cause an unspecified impact. Multiple connected sources corroborate the vulnerability, including CVE records ...

CVE-2010-2997

CVE-2010-2997 is tied to multiple advisories (RHSA-2010:0981, CESA-2010:0981) and OpenVAS/Nessus entries describing multiple security flaws in RealPlayer/HelixPlayer, potentially enabling arbitrary code execution via crafted media/stream content. Remediation across affected platforms centers on r...

CVE-2004-0550

CVE-2004-0550 describes a buffer overflow in RealNetworks RealPlayer 10 that allows remote code execution when a user visits a URL containing a large sequence of periods. Affected: RealPlayer 10 (RealNetworks). Exploitation described as remote and requires no user interaction in the NVD entry, wi...

CVE-2005-0192

CVE-2005-0192 : Directory traversal vulnerability in RealPlayer 10.5 (6.0.12.1040) and earlier, in parsing of RealPlayer Skin filenames, allows remote attackers to read arbitrary files via a .. in an RJS filename. Affected product: RealPlayer/RealPlayer for Windows (RealPlayer 10.5 and earlier). ...

CVE-2010-3751

CVE-2010-3751 concerns multiple heap-based buffer overflows in the RealPlayer ActiveX control. The vulnerability arises when processing a long ".smil" argument in the tfile, pnmm, or cdda protocol handlers, allowing remote attackers to execute arbitrary code. Affected software includes RealPlayer...

CVE-2011-2954

CVE-2011-2954 is a use-after-free vulnerability in RealNetworks RealPlayer, affecting RealPlayer 11.0–11.1 and 14.0.0–14.0.5 (and RealPlayer SP 1.0–1.1.5) when using an Embedded RealPlayer. The issue occurs in the Embedded AutoUpdate path and can allow remote attackers to execute arbitrary code v...

CVE-2013-3299

RealNetworks RealPlayer

CVE-2005-2052

CVE-2005-2052 describes a heap-based buffer overflow in vidplin.dll used by RealPlayer family (RealPlayer 8/Enterprise, RealPlayer 10/10.5, RealOne Player v1/v2). The flaw is triggered by processing an .avi file with a modified strf structure value, allowing remote attackers to attempt arbitrary ...