CVE-2010-4396

RealPlayer 11.0-11.1 and RealPlayer SP 1.0-1.1.5 - Cross-Zone Scripting via HandleAction Method

Title source: llm
STIX 2.1

Description

Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/69855
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-10-275
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1024861

Scores

EPSS 0.0029
EPSS Percentile 52.0%

Details

CWE
CWE-20
Status published
Products (18)
realnetworks/realplayer 11.0
realnetworks/realplayer 11.0.1
realnetworks/realplayer 11.0.2
realnetworks/realplayer 11.0.3
realnetworks/realplayer 11.0.4
realnetworks/realplayer 11.0.5
realnetworks/realplayer 11.1
realnetworks/realplayer 2.1.2
realnetworks/realplayer_sp 1.0.0
realnetworks/realplayer_sp 1.0.1
... and 8 more
Published Dec 14, 2010
Tracked Since Feb 18, 2026