CVE-2010-4388

RealPlayer 11.0-11.1 and RealPlayer SP 1.0-1.1.5 - Remote Code Execution via HTML Component Injection

Title source: llm
STIX 2.1

Description

The (1) Upsell.htm, (2) Main.html, and (3) Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended Local Machine Zone restrictions and load arbitrary ActiveX controls, via unspecified vectors.

References (8)

Core 8
Core References
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-10-276
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-10-278
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69859
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69858
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024861
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69857
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-10-277

Scores

EPSS 0.0039
EPSS Percentile 59.9%

Details

CWE
CWE-20
Status published
Products (19)
realnetworks/realplayer 11.0
realnetworks/realplayer 11.0.1
realnetworks/realplayer 11.0.2
realnetworks/realplayer 11.0.3
realnetworks/realplayer 11.0.4
realnetworks/realplayer 11.0.5
realnetworks/realplayer 11.1
realnetworks/realplayer 2.1.2
realnetworks/realplayer 2.1.3
realnetworks/realplayer_sp 1.0.0
... and 9 more
Published Dec 14, 2010
Tracked Since Feb 18, 2026