ID CVE-2007-5080
Summary Integer overflow in RealNetworks RealPlayer 10 and 10.5, RealOne Player 1, and RealPlayer Enterprise for Windows allows remote attackers to execute arbitrary code via a crafted Lyrics3 2.00 tag in an MP3 file, resulting in a heap-based buffer overflow.
References
Vulnerable Configurations
  • cpe:2.3:a:realnetworks:realone_player:1.0:*:windows:en:*:*:*:*
    cpe:2.3:a:realnetworks:realone_player:1.0:*:windows:en:*:*:*:*
  • cpe:2.3:a:realnetworks:realone_player:2.0:*:windows:*:*:*:*:*
    cpe:2.3:a:realnetworks:realone_player:2.0:*:windows:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:10.0:*:windows:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:10.0:*:windows:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1040:windows:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1040:windows:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1578:windows:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1578:windows:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1698:windows:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1698:windows:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1741:windows:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1741:windows:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:windows:en:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:windows:en:*:*:*:*
CVSS
Base: 9.3 (as of 29-07-2017 - 01:33)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
refmap via4
bid 26214
cert-vn VU#759385
confirm http://service.real.com/realplayer/security/10252007_player/en/
misc http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-real-player-id3-tags/
sectrack 1018866
secunia 27361
vim 20071030 RealPlayer Updates of October 25, 2007
vupen ADV-2007-3628
xf realplayer-mp3-bo(37434)
statements via4
contributor Mark J Cox
lastmodified 2007-11-01
organization Red Hat
statement Not vulnerable. This issue did not affect the versions of RealPlayer as shipped with Red Hat Enterprise Linux 3 Extras, 4 Extras, or 5 Supplementary.
Last major update 29-07-2017 - 01:33
Published 31-10-2007 - 17:46
Last modified 29-07-2017 - 01:33
Back to Top