CVE-2010-3751

RealPlayer 11.0-11.1 and RealPlayer SP 1.0-1.1.4 - Remote Code Execution via Long .smil Argument

Title source: llm
STIX 2.1

Description

Multiple heap-based buffer overflows in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 allow remote attackers to execute arbitrary code via a long .smil argument to the (1) tfile, (2) pnmm, or (3) cdda protocol handler.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/44144
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-10-213/

Scores

EPSS 0.0583
EPSS Percentile 90.6%

Details

CWE
CWE-119
Status published
Products (16)
realnetworks/realplayer 11.0
realnetworks/realplayer 11.0.1
realnetworks/realplayer 11.0.2
realnetworks/realplayer 11.0.3
realnetworks/realplayer 11.0.4
realnetworks/realplayer 11.0.5
realnetworks/realplayer 11.1
realnetworks/realplayer_sp 1.0.0
realnetworks/realplayer_sp 1.0.1
realnetworks/realplayer_sp 1.0.2
... and 6 more
Published Oct 19, 2010
Tracked Since Feb 18, 2026