CVE-2007-2263 Heap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and possibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an SWF (Flash) file...
HighCVSS 9.3
EPSS 7.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and possibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an SWF (Flash) file with malformed record headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| realnetworks realone player | All versions | No fix listed |
| realnetworks realone player | = 2.0 | No fix listed |
| realnetworks realplayer | = 10.0 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.0.305 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.0.331 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.0.352 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.5 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.6 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.7 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.8 | No fix listed |
| realnetworks realplayer | = 10.0-10.0.9 | No fix listed |
| realnetworks realplayer | = 10.1-10.0.0.396 | No fix listed |
| realnetworks realplayer | = 10.1-10.0.0.412 | No fix listed |
| realnetworks realplayer | = 10.5-6.0.12.1040 | No fix listed |
| realnetworks realplayer | = 10.5-6.0.12.1578 | No fix listed |
| realnetworks realplayer | = 10.5-6.0.12.1698 | No fix listed |
| realnetworks realplayer | = 10.5-6.0.12.1741 | No fix listed |
| realnetworks realplayer enterprise | All versions | No fix listed |
References
- 38344 vdb-entry
- 27361 patch third-party-advisory vendor-advisory
- service.real.com patch
- 20071030 RealPlayer Updates of October 25, 2007 mailing-list
- 20071031 ZDI-07-061: RealNetworks RealPlayer SWF Processing Remote Code Execution Vulnerability mailing-list
- 26214 patch vdb-entry
- 26284 vdb-entry
- 1018866 vdb-entry
- ADV-2007-3628 vdb-entry vendor-advisory
- www.zerodayinitiative.com
- realplayer-swf-bo(37436) vdb-entry
- oval:org.mitre.oval:def:11432 signature vdb-entry