ID CVE-2010-2999
Summary Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed MLLT atom in an AAC file.
References
Vulnerable Configurations
  • cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
    cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 19-01-2011 - 06:59)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
refmap via4
confirm http://service.real.com/realplayer/security/12102010_player/en/
misc http://www.zerodayinitiative.com/advisories/ZDI-10-273
sectrack 1024861
Last major update 19-01-2011 - 06:59
Published 14-12-2010 - 16:00
Last modified 19-01-2011 - 06:59
Back to Top