Heap-based buffer overflow in vidplin.dll in RealPlayer 10 and 10.5 (6.0.12.1040 through 1069), RealOne Player v1 and v2, RealPlayer 8 and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an .avi file with a modified strf structure value.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Realone_player | Realnetworks | 1.0 (including) | 1.0 (including) |
| Realone_player | Realnetworks | 2.0 (including) | 2.0 (including) |
| Realplayer | Realnetworks | * | * |
| Realplayer | Realnetworks | 8.0 (including) | 8.0 (including) |
| Realplayer | Realnetworks | 10.0 (including) | 10.0 (including) |
| Realplayer | Realnetworks | 10.5_6.0.12.1040 (including) | 10.5_6.0.12.1040 (including) |
| Realplayer | Realnetworks | 10.5_6.0.12.1069 (including) | 10.5_6.0.12.1069 (including) |
| Helix-player | Ubuntu | dapper | * |
| Helix-player | Ubuntu | devel | * |
| Helix-player | Ubuntu | edgy | * |
| Helix-player | Ubuntu | feisty | * |
References
- http://marc.info/?l=bugtraq\u0026m=111955853611840\u0026w=2
- http://service.real.com/help/faq/security/050623_player/EN/
- http://marc.info/?l=bugtraq\u0026m=111955853611840\u0026w=2
- http://service.real.com/help/faq/security/050623_player/EN/