CVSS: 10.0EPSS: 0%CPEs: 17EXPL: 0CVE-2010-3748
https://notcve.org/view.php?id=CVE-2010-3748
Stack-based buffer overflow in the RichFX component in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 allows remote attackers to have an unspecified impact via unknown vectors. Desbordamiento de buffer basado en pila en el componente RichFX de RealNetworks RealPlayer v11.0 hasta la v11.1, RealPlayer SP 1.0 hasta la v1.1.4, y RealPlayer Enterprise v2.1.2 permite a atacantes remotos provocar una impacto sin determinar a través de vectores desconocidos. • http://service.real.com/realplayer/security/10152010_player/en http://www.securityfocus.com/bid/44144 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 95%CPEs: 17EXPL: 1CVE-2010-3747 – RealNetworks RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-3747
An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and application crash) via a long URI. Un control ActiveX en RealNetworks RealPlayer v11.0 hasta la v11.1, RealPlayer SP v1.0 hasta la v1.1.4, y RealPlayer Enterprise v2.1.2 no inicializa apropiadamente un componente objeto sin especificar durante el parseo de una URI CDDA, lo que permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (resolución de puntero sin inicializar y caída de la aplicación) a través de una URI extensa. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists during the parsing of long CDDA URIs due to a failure to initialize a particular component of an object. The application will later call a method in the object leading to the uninitialized pointer being called. • https://www.exploit-db.com/exploits/16998 http://securityreason.com/securityalert/8147 http://service.real.com/realplayer/security/10152010_player/en http://www.securityfocus.com/bid/44144 http://www.zerodayinitiative.com/advisories/ZDI-10-210 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 10%CPEs: 17EXPL: 0CVE-2010-3750 – RealNetworks RealPlayer RJMDSections Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-3750
rjrmrpln.dll in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly validate file contents that are used during interaction with a heap buffer, which allows remote attackers to execute arbitrary code via crafted Name Value Property (NVP) elements in logical streams in a media file. rjrmrpln.dll en RealNetworks RealPlayer v11.0 hasta la v11.1, RealPlayer SP 1.0 hasta la v1.1.4, y RealPlayer Enterprise v2.1.2 no valida apropiadamente el contenido de un fichero utilizado durante la interacción con un desbordamiento de memoria dinámica, lo que permite a atacantes remotos ejecutar código de su elección a través de elementos "Name Value Property" (NVP) en streams lógicos de un archivo multimedia. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a target must open a malicious website or media file. The specific flaw exists within the code responsible for parsing Name Value Property (NVP) elements from within logical streams in a RealPlayer media file. Specifically, a function within the rjrmrpln.dll file allocates a buffer on the heap which can be directly influenced from data within the file. This buffer is then written to using another value defined in the file and thus also controlled. • http://service.real.com/realplayer/security/10152010_player/en http://www.securityfocus.com/bid/44144 http://www.zerodayinitiative.com/advisories/ZDI-10-212 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 5%CPEs: 1EXPL: 2CVE-2007-2497 – RealPlayer 10 - '.ra' Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-2497
RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service (memory consumption) via a certain .ra file. NOTE: this issue was referred to as a "memory leak," but it is not clear if this is correct. RealNetworks RealPlayer 10 Gold permite a atacantes remotos provocar una denegación de servicio (agotamiento de memoria) mediante un fichero .ra concreto. NOTA. Este tema fue tratado como un "agujero de memoria" pero no está claro que sea correcto. • https://www.exploit-db.com/exploits/3819 http://osvdb.org/41730 http://www.securityfocus.com/bid/23712 •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2005-4126
https://notcve.org/view.php?id=CVE-2005-4126
** UNVERIFIABLE, PRERELEASE ** NOTE: this issue describes a problem that can not be independently verified as of 20051208. Unspecified vulnerability in unspecified versions of Real Networks RealPlayer allows attackers to execute arbitrary code. NOTE: the information regarding this issue is extremely vague and does not provide any verifiable information. It has been posted by a reliable reporter with a prerelease disclosure policy. This item has only been assigned a CVE identifier for tracking purposes, and to serve as a concrete example for discussion of the newly emerging UNVERIFIABLE and PRERELEASE content decisions in CVE, which must be discussed by the Editorial Board. • http://www.eeye.com/html/research/upcoming/20051130.html http://www.securityfocus.com/bid/15691 •