CVE-2010-3747

Realnetworks Realplayer - Memory Corruption

Title source: rule

Description

An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and application crash) via a long URI.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16998
metasploit WORKING POC NORMAL
by bannedit, sinn3r · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/realplayer_cdda_uri.rb

Scores

EPSS 0.6653
EPSS Percentile 98.5%

Details

CWE
CWE-119
Status published
Products (17)
realnetworks/realplayer 11.0
realnetworks/realplayer 11.0.1
realnetworks/realplayer 11.0.2
realnetworks/realplayer 11.0.3
realnetworks/realplayer 11.0.4
realnetworks/realplayer 11.0.5
realnetworks/realplayer 11.1
realnetworks/realplayer 2.1.2
realnetworks/realplayer_sp 1.0.0
realnetworks/realplayer_sp 1.0.1
... and 7 more
Published Oct 19, 2010
Tracked Since Feb 18, 2026