CVEvulnerability
CVE-2007-5601
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-10-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-119
Description
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.
Affected configurations
• realnetworks realplayer 10.0
• realnetworks realplayer 10.5
• realnetworks realplayer 11 beta
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://secunia.com/advisories/27248 Vendor Advisory
- http://service.real.com/realplayer/security/191007_player/en/ service.real.com
- http://www.infosecblog.org/2007/10/nasa-bans-ie.html www.infosecblog.org
- http://www.kb.cert.org/vuls/id/871673 US Government Resource
- http://www.securityfocus.com/bid/26130 www.securityfocus.com
- http://www.securitytracker.com/id?1018843 www.securitytracker.com
- http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html www.symantec.com
- http://www.us-cert.gov/cas/techalerts/TA07-297A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/3548 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37280 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/27248 Vendor Advisory
- http://service.real.com/realplayer/security/191007_player/en/ service.real.com
- http://www.infosecblog.org/2007/10/nasa-bans-ie.html www.infosecblog.org
- http://www.kb.cert.org/vuls/id/871673 US Government Resource
- http://www.securityfocus.com/bid/26130 www.securityfocus.com
- http://www.securitytracker.com/id?1018843 www.securitytracker.com
- http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html www.symantec.com
- http://www.us-cert.gov/cas/techalerts/TA07-297A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/3548 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37280 exchange.xforce.ibmcloud.com