CVE-2011-2954

Use-after-free vulnerability in the AutoUpdate feature in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://service.real.com/realplayer/security/08162011_player/en/	Vendor Advisory
http://www.securitytracker.com/id?1025943

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:realnetworks:realplayer:11.0:::::::*
	cpe:2.3:a:realnetworks:realplayer:11.1:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:realnetworks:realplayer:14.0.3:::::::*
	cpe:2.3:a:realnetworks:realplayer:14.0.4:::::::*
	cpe:2.3:a:realnetworks:realplayer:14.0.5:::::::*
	cpe:2.3:a:realnetworks:realplayer:14.0.1:::::::*
	cpe:2.3:a:realnetworks:realplayer:14.0.2:::::::*
	cpe:2.3:a:realnetworks:realplayer:14.0.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.1:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:::::::*
	cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:::::::*

Information

Published : 2011-08-18 16:55

Updated : 2011-10-05 19:50

NVD link : CVE-2011-2954

Mitre link : CVE-2011-2954

JSON object : View

CWE

CWE-399

Resource Management Errors

Advertisement

Products Affected

realnetworks

realplayer_sp
realplayer

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://service.real.com/realplayer/security/08162011_player/en/", "name": "http://service.real.com/realplayer/security/08162011_player/en/", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securitytracker.com/id?1025943", "name": "1025943", "tags": [], "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Use-after-free vulnerability in the AutoUpdate feature in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-399"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-2954", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2011-08-18T23:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:14.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:14.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:14.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2011-10-06T02:50Z"}