CVE-2012-5691

CVE-2012-5691 is a buffer overflow in RealNetworks RealPlayer prior to 16.0.0.282 and RealPlayer SP 1.0–1.1.5 that allows remote code execution via a crafted RealMedia file. Connected advisories and exploits confirm real-world discussion and tooling around RealPlayer RealMedia file handling BOF (...

CVE-2010-3747

CVE-2010-3747 affects RealNetworks RealPlayer ActiveX control; the vulnerability stems from uninitialized memory during parsing of CDDA URIs, allowing remote code execution or denial of service via a long URI. Affected products include RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer...

CVE-2009-4245

CVE-2009-4245 is a heap-based buffer overflow in RealNetworks RealPlayer/HelixPlayer GIF processing (gifcodec.cpp/gifimage.cpp). Affected products include RealPlayer 10, 10.5 (6.0.12.1040–1741), RealPlayer 11 (11.0.0–11.0.4), RealPlayer Enterprise, Mac/Linux RealPlayer 10/10.1, and Helix Player 1...

CVE-2009-4257

CVE-2009-4257 is a heap-based buffer overflow in SMIL handling within HelixPlayer/RealPlayer (smlrender.dll/smlpkt.cpp) that could allow remote code execution when processing crafted SMIL data. Public advisories (Red Hat RHSA-2010-0094, CentOS/SuSE/Oracle Linux updates, OpenVAS/NASL entries) docu...

CVE-2010-4378

CVE-2010-4378 affects RealPlayer/HelixPlayer family. The drv2.dll RV20 decompression component can be triggered by a crafted RV20 video stream length field, leading to remote arbitrary code execution or heap memory corruption. Affected products include RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1....

CVE-2009-4242

CVE-2009-4242 is a heap-based buffer overflow in the GIF handling path of HelixPlayer/RealPlayer (GIF codec) that can be triggered by a crafted GIF file. Public docs corroborate that multiple GIF-related heap/overflow flaws affected HelixPlayer/RealPlayer and could allow remote code execution (no...

CVE-2009-4243

RealPlayer/Helix vulnerability CVE-2009-4243 stems from an integer/heap overflow in the handling of HTTP chunked transfer encoded media. Affects RealPlayer 10–11 (Windows, Mac, Linux) and Helix Player 10.x. Remote code execution could be possible as described by multiple advisories; exploitation ...

CVE-2010-4376

CVE-2010-4376 describes a heap-based buffer overflow in RealNetworks RealPlayer 11.x (Windows, Mac, Linux) and RealPlayer SP 1.x, triggered by a large Screen Width value in the GIF87a Screen Descriptor of an RTSP stream. This allows remote code execution. Public sources in the provided documents ...

CVE-2010-4383

CVE-2010-4383 is among a set of flaws in RealPlayer/Helix Player (RealPlayer 11.x, SP, Enterprise, Mac/Linux RealPlayer; HelixPlayer) that share a common codebase. The connected documents confirm multiple security flaws could be triggered by opening or playing malicious media files/streams, poten...

CVE-2012-5690

CVE-2012-5690 affects RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0–1.1.5. The root cause is a flaw in processing RealAudio data that can trigger access to an invalid pointer, allowing remote code execution. The vulnerability is exploitable by a crafted RealAudio file sent over ...

CVE-2009-4248

CVE-2009-4248 describes a buffer overflow in RealPlayer/HelixPlayer’s RTSP SET_PARAMETER handling (RTSPProtocol::HandleSetParameterRequest). A crafted RTSP SET_PARAMETER request could crash the application or potentially allow arbitrary code execution. Affected products include RealPlayer 10/10.5...

CVE-2010-4393

RealNetworks RealPlayer vulnerability CVE-2010-4393 involves a heap-based buffer overflow in vidplin.dll when parsing AVI headers. Affected products include RealPlayer 11.0–11.1 and 14.0.x before 14.0.2, and RealPlayer SP 1.0–1.1.5. The issue permits remote code execution via a crafted AVI header...

CVE-2012-2406

RealPlayer and RealPlayer SP are affected by CVE-2012-2406 due to improper parsing of ASMRuleBook data in RealMedia files, enabling remote code execution via a crafted file. Affected products include RealNetworks RealPlayer before 15.0.4.53 and RealPlayer SP 1.0–1.1.5. The vulnerability enables a...

CVE-2009-4246

CVE-2009-4246 is a RealPlayer/Helix vulnerability: a stack-based buffer overflow in RealPlayer 10/10.5, RealPlayer 11, RealPlayer Enterprise, Mac/Linux RealPlayer 10/10.1, and Helix Player 10.x could allow user-assisted remote code execution via a malformed .RJS skin file containing a crafted web...

CVE-2010-2997

CVE-2010-2997 is tied to multiple advisories (RHSA-2010:0981, CESA-2010:0981) and OpenVAS/Nessus entries describing multiple security flaws in RealPlayer/HelixPlayer, potentially enabling arbitrary code execution via crafted media/stream content. Remediation across affected platforms centers on r...

CVE-2010-2578

CVE-2010-2578 is a heap-based buffer overflow in RealNetworks RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer Enterprise 2.1.2 that can be exploited by a crafted QCP file to cause an unspecified impact. Multiple connected sources corroborate the vulnerability, including CVE records ...

CVE-2011-2954

CVE-2011-2954 is a use-after-free vulnerability in RealNetworks RealPlayer, affecting RealPlayer 11.0–11.1 and 14.0.0–14.0.5 (and RealPlayer SP 1.0–1.1.5) when using an Embedded RealPlayer. The issue occurs in the Embedded AutoUpdate path and can allow remote attackers to execute arbitrary code v...

CVE-2010-3751

CVE-2010-3751 concerns multiple heap-based buffer overflows in the RealPlayer ActiveX control. The vulnerability arises when processing a long ".smil" argument in the tfile, pnmm, or cdda protocol handlers, allowing remote attackers to execute arbitrary code. Affected software includes RealPlayer...

CVE-2010-4388

The CVE-2010-4388 issue affects RealNetworks RealPlayer suites (RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, RealPlayer Enterprise 2.1.2–2.1.3). Concrete details in connected sources show a uniform vulnerability in the RealOneActiveXObject handling within Upsell.htm, Main.html, and Custsupport....

CVE-2011-2945

RealPlayer (Windows) is affected by CVE-2011-2945 due to a heap-based buffer overflow in SIPR within RealPlayer 11.0–11.1 and 14.0.0–14.0.5. This allows remote code execution via a crafted SIPR stream. Public sources confirm the vulnerability and CVE mapping, but none of the connected documents p...

CVE-2011-2953

CVE-2011-2953 concerns RealNetworks RealPlayer ActiveX control in several RealPlayer variants (RealPlayer 11.0–11.1 and 14.0.0–14.0.5; RealPlayer SP 1.0–1.1.5; RealPlayer Enterprise 2.0–2.1.5). The vulnerability is described as an out-of-bounds condition in the browser plugin that enables remote ...

CVE-2010-4379

CVE-2010-4379 describes a heap-based buffer overflow in RealPlayer (versions 11.0–11.1, SP 1.0–1.1.4, Enterprise 2.1.2, Mac/Linux RealPlayer 11.0–11.1, HelixPlayer 1.0.6) via crafted SIPR files. Connected advisories confirm RealPlayer/HelixPlayer flaws could, when opening or playing a malicious f...

CVE-2011-2952

RealPlayer family (RealPlayer 11.0–11.1, 14.0.0–14.0.5; RealPlayer SP 1.0–1.1.5; RealPlayer Enterprise 2.0–2.1.5) is affected by a use-after-free in dialog box handling that allows remote code execution. This is CVE-2011-2952. The vulnerability is triggered via dialog-box-related vectors and can ...

CVE-2009-4241

CVE-2009-4241 is a RealNetworks RealPlayer/Helix Player heap-based buffer overflow vulnerability. The entry specifies a remote code execution risk via a crafted file with invalid ASMRuleBook structures causing heap memory corruption in RealPlayer 10, 10.5 (6.0.12.1040–6.0.12.1741), RealPlayer 11 ...

CVE-2009-4247

CVE-2009-4247 is a real vulnerability in HelixPlayer/RealPlayer where a stack-based buffer/RuleBook overflow in the RTSP/RuleBook handling could crash the player or allow arbitrary code execution. Affected products span RealPlayer 10 and 10.5, RealPlayer 11, RealPlayer SP, RealPlayer Enterprise, ...

CVE-2010-2999

RealNetworks RealPlayer vulnerable to integer overflow via a malformed MLLT atom in AAC files (CVE-2010-2999). Affected: RealPlayer 11.0–11.1 (Windows/macOS/Linux), RealPlayer SP 1.0.x; exploitation via AAC MLLT parsing can lead to remote code execution or heap memory corruption. The ZDI advisory...

CVE-2011-2951

CVE-2011-2951 describes a buffer overflow in RealNetworks RealPlayer affecting multiple versions (RealPlayer 11.0–11.1, 14.0.0–14.0.5; RealPlayer SP 1.0–1.1.5; Mac RealPlayer 12.0.0.1569) that can allow remote code execution via a crafted raw_data_frame field in an AAC file. Root cause: improper ...

CVE-2012-0927

CVE-2012-0927 affects RealNetworks RealPlayer 11.x, 14.x and 15.x prior to 15.02.71, and RealPlayer SP 1.0–1.1.5. The flaw resides in the RealAudio stream’s coded_frame_size handling (cook.dll); the parsed RA2 header uses coded_frame_size to allocate memory, which is not properly verified, enabli...

CVE-2013-1750

RealNetworks RealPlayer is affected by a heap-based buffer overflow (CVE-2013-1750) that allows remote code execution when processing a malformed MP4 file. The vulnerable products listed include RealPlayer prior to version 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5. The root cause is a heap-ba...

CVE-2013-4973

CVE-2013-4973 concerns RealNetworks RealPlayer before 16.0.3.51 (and RealPlayer SP 1.0–1.1.5). The issue is a stack-based buffer overflow in handling RealPlayer Metadata Package (RMP) filenames, exploitable via a crafted .rmp file, allowing remote code execution in the context of the user. OpenVA...

CVE-2011-1221

CVE-2011-1221 is a cross-zone scripting vulnerability in the RealPlayer ActiveX control affecting RealPlayer 11.0–11.1, 14.0.0–14.0.5; RealPlayer SP 1.0–1.1.5; and RealPlayer Enterprise 2.0–2.1.5. The issue allows remote attackers to inject arbitrary web script or HTML in the Local Zone via a loc...

CVE-2012-1904

CVE-2012-1904 affects RealNetworks RealPlayer (RealPlayer 15 and earlier; RealPlayer SP 1.1.4 Build 12.0.0.756 and earlier) via mp4fformat.dll in the QuickTime File Format plugin. A crafted MP4 file can trigger memory corruption and an application crash, enabling a remote attacker to cause a deni...

CVE-2010-3000

CVE-2010-3000 affects RealNetworks RealPlayer (RealPlayer 11.0–11.1 and RealPlayer SP 1.0–1.1.4 on Windows). The vulnerability arises from two integer overflow errors in the FLV parsing of AMF data (HX_FLV_META_AMF_TYPE_MIXEDARRAY and HX_FLV_META_AMF_TYPE_ARRAY) within the ParseKnownType function...

CVE-2010-3748

CVE-2010-3748 covers a stack-based buffer overflow in RealNetworks RealPlayer’s RichFX component. Affected products include RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.4, and RealPlayer Enterprise 2.1.2. The core issue is a RichFX overflow that could allow remote code execution; Microsoft MSVR ad...

CVE-2010-4381

CVE-2010-4381 describes a heap-based buffer overflow in RealNetworks RealPlayer products (RealPlayer 11.x, RealPlayer SP, RealPlayer Enterprise, and Mac RealPlayer up to 12.0.0.1444) that is triggered by a crafted AAC file. The vulnerability permits remote attackers to achieve unspecified impact....

CVE-2011-2950

RealPlayer (RealPlayer 11.0–11.1 and 14.0.0–14.0.5; RealPlayer SP 1.0–1.1.5) is affected by a heap-based buffer overflow in qcpfformat.dll when parsing .qcp files. The vulnerability allows remote code execution via a crafted QCP file, as reported for CVE-2011-2950. The issue originates from insuf...

CVE-2011-2955

CVE-2011-2955 is a use-after-free vulnerability in RealNetworks RealPlayer when using an Embedded RealPlayer, allowing remote code execution via vectors related to a modal dialog. Affected products include RealPlayer 11.0–11.1, 14.0.0–14.0.5 (and RealPlayer SP 1.0–1.1.5, RealPlayer Enterprise 2.0...

CVE-2010-2998

CVE-2010-2998 : RealNetworks RealPlayer (Windows) is affected by an array index error in parsing RealMedia IVR data, leading to remote code execution. Impact: arbitrary code could be run in the context of the logged-in user when a vulnerable RealPlayer instance processes a malformed IVR file. Aff...

CVE-2012-2407

Technical summary (CVE-2012-2407) RealPlayer and RealPlayer SP prior to version 15.0.6.14 (Windows/macOS RealPlayer before 12.0.1.1750; RealPlayer SP 1.0–1.1.5) are affected by a buffer overflow in AAC stream-data unpacking , allowing a remote attacker to cause a denial of service and potentially...

CVE-2012-2408

CVE-2012-2408: RealPlayer’s AAC SDK in RealPlayer (and RealPlayer SP) before the listed fixed versions contains a vulnerability in decoding crafted AAC files that can cause heap memory corruption and a denial of service. Affected products include RealPlayer before 15.0.6.14 (Windows), RealPlayer ...

CVE-2009-4244

RealNetworks RealPlayer vulnerability (CVE-2009-4244) is a heap-based buffer overflow in RealPlayer 10, RealPlayer 10.5 (6.0.12.1040–6.0.12.1741), RealPlayer 11 (11.0.0–11.0.4), RealPlayer Enterprise, Mac RealPlayer 10/10.1/11.0, Linux RealPlayer 10, and Helix Player 10.x. The flaw arises from an...

CVE-2010-0116

CVE-2010-0116 affects RealNetworks RealPlayer for Windows (RealPlayer 11.0–11.1 and RealPlayer SP 1.0–1.1.4). The flaw is an integer overflow in QCP parsing that may cause a heap-based buffer overflow, enabling remote code execution. OpenVAS/Nessus listings corroborate RealPlayer Windows vulnerab...

CVE-2010-4377

The CVE-2010-4377 entry corresponds to a RealPlayer heap-based buffer overflow in RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, Mac RealPlayer 11.0–12.0.0.1444, and Linux RealPlayer 11.0.2.1744. The underlying issue occurs when processing the cook audio codec data in a Real Audio file, where spe...

CVE-2010-4386

CVE-2010-4386 affects RealPlayer 11.x, RealPlayer SP 1.x, Linux RealPlayer 11.0.2.1744, and HelixPlayer 1.0.6 and related builds. The root cause is heap memory corruption triggered by a crafted RealMedia file, enabling remote arbitrary code execution or a denial of service. Public advisories show...

CVE-2011-1426

RealNetworks RealPlayer OpenURLInDefaultBrowser vulnerability (CVE-2011-1426) affects RealPlayer 11.0–11.1 and 14.0.0–14.0.2, and RealPlayer SP 1.0–1.1.5. The OpenURLInDefaultBrowser() method launches the system default handler for the first argument’s filename, enabling remote attackers to execu...

CVE-2011-2947

CVE-2011-2947 relates to a cross-zone scripting vulnerability in the RealPlayer ActiveX control. Affected products include RealPlayer 11.0–11.1 and 14.0.0–14.0.5, as well as RealPlayer SP 1.0–1.1.5 (per the description). The flaw allows remote attackers to inject arbitrary web script or HTML into...

CVE-2012-0926

The CVE-2012-0926 vulnerability affects RealNetworks RealPlayer: the RV10 RealVideo stream handling in RealPlayer 11.x, 14.x, 15.x (and RealPlayer SP 1.0–1.1.5) fails to validate height/width fields, allowing remote code execution via a crafted RV10 video. Root cause is miscalculation of an offse...

CVE-2010-0120

CVE-2010-0120 corresponds to a heap-based buffer overflow in RealNetworks RealPlayer 11.0–11.1 and RealPlayer SP 1.0–1.1.4 on Windows. The vulnerability arises from processing large size values in QCP audio content and allows remote arbitrary-code execution. Connected sources (OpenVAS/NVD/Nessus ...

CVE-2010-3001

CVE-2010-3001 affects RealNetworks RealPlayer ActiveX control in the IE plugin for RealPlayer 11.0–11.1 and RealPlayer SP 1.0–1.1.4 on Windows. The root cause involves how RealPlayer handles multiple instantiations of the ActiveX plug‑in across multiple Internet Explorer windows, enabling remote ...

CVE-2010-4392

CVE-2010-4392 is a heap-based buffer overflow in RealPlayer/HelixPlayer family that allows remote code execution via crafted ImageMap data in RealMedia files. Affected: RealPlayer 11.0–11.1, RealPlayer SP 1.0–1.1.5, RealPlayer Enterprise 2.1.2–2.1.3, Linux RealPlayer 11.0.2.1744, possibly HelixPl...