CVEvulnerability
CVE-2008-1309
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-03-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-399
Description
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.
Affected configurations
• realnetworks realplayer
• realnetworks realplayer 10.0
• realnetworks realplayer 10.5
• realnetworks realplayer 11
Related
Weakness · not in database (1)
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060659.html lists.grok.org.uk
- http://secunia.com/advisories/29315 Vendor Advisory
- http://service.real.com/realplayer/security/07252008_player/en/ Vendor Advisory
- http://www.kb.cert.org/vuls/id/831457 US Government Resource
- http://www.securityfocus.com/archive/1/494779/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28157 Exploit
- http://www.securitytracker.com/id?1019576 www.securitytracker.com
- http://www.securitytracker.com/id?1020563 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/0842 Vendor Advisory
- http://www.vupen.com/english/advisories/2008/2194/references Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-047/ www.zerodayinitiative.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41087 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/5332 www.exploit-db.com
- http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060659.html lists.grok.org.uk
- http://secunia.com/advisories/29315 Vendor Advisory
- http://service.real.com/realplayer/security/07252008_player/en/ Vendor Advisory
- http://www.kb.cert.org/vuls/id/831457 US Government Resource
- http://www.securityfocus.com/archive/1/494779/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28157 Exploit
- http://www.securitytracker.com/id?1019576 www.securitytracker.com
- http://www.securitytracker.com/id?1020563 www.securitytracker.com
- http://www.vupen.com/english/advisories/2008/0842 Vendor Advisory
- http://www.vupen.com/english/advisories/2008/2194/references Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-047/ www.zerodayinitiative.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41087 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/5332 www.exploit-db.com