CVE-2010-4378

RealPlayer 11.0-11.1 and RealPlayer SP 1.0-1.1.5 - Remote Code Execution via RV20 Video Stream Length Field

Title source: llm
STIX 2.1

Description

The drv2.dll (aka RV20 decompression) module in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.1.2 and 2.1.3, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted value of an unspecified length field in an RV20 video stream.

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0981.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024861
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-10-274

Scores

EPSS 0.0307
EPSS Percentile 86.9%

Details

CWE
CWE-119
Status published
Products (20)
realnetworks/realplayer 11.0
realnetworks/realplayer 11.0.1
realnetworks/realplayer 11.0.2
realnetworks/realplayer 11.0.3
realnetworks/realplayer 11.0.4
realnetworks/realplayer 11.0.5
realnetworks/realplayer 11.1
realnetworks/realplayer 11.0.2.1744
realnetworks/realplayer 2.1.2
realnetworks/realplayer 2.1.3
... and 10 more
Published Dec 14, 2010
Tracked Since Feb 18, 2026