RealPlayer for Windows < Build Multiple Buffer Overflows

High Nessus Plugin ID 44119


The remote Windows application is affected by multiple buffer overflow vulnerabilities.


According to its build number, the installed version of RealPlayer on the remote Windows host has multiple buffer overflow vulnerabilities :

- A RealPlayer 'ASM' Rulebook heap-based overflow. (CVE-2009-4241)

- A RealPlayer 'GIF' file heap overflow. (CVE-2009-4242)

- A RealPlayer media overflow ('http' chunk encoding).

- A RealPlayer 'IVR' file processing buffer overflow.

- A RealPlayer 'IVR' file heap overflow. (CVE-2009-0376)

- A RealPlayer 'SIPR' codec heap overflow. (CVE-2009-4244)

- A RealPlayer compressed 'GIF' heap overflow. (CVE-2009-4245)

- A RealPlayer 'SMIL' parsing heap overflow. (CVE-2009-4257)

- A RealPlayer skin parsing stack overflow. (CVE-2009-4246)

- A RealPlayer 'ASM' RuleBook Array Overflow. (CVE-2009-4247)

- A RealPlayer 'rtsp' set_parameter buffer overflow.


Upgrade to RealPlayer SP 1.0.2 or later.

See Also

Plugin Details

Severity: High

ID: 44119

File Name: realplayer_12_0_0_319.nasl

Version: $Revision: 1.13 $

Type: local

Agent: windows

Family: Windows

Published: 2010/01/22

Modified: 2016/12/09

Dependencies: 20183

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:realnetworks:realplayer

Required KB Items: SMB/RealPlayer/Product, SMB/RealPlayer/Build

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/01/19

Vulnerability Publication Date: 2010/01/19

Reference Information

CVE: CVE-2009-0375, CVE-2009-0376, CVE-2009-4241, CVE-2009-4242, CVE-2009-4243, CVE-2009-4244, CVE-2009-4245, CVE-2009-4246, CVE-2009-4247, CVE-2009-4248, CVE-2009-4257

BID: 33652, 37880

OSVDB: 54297, 54298, 61965, 61966, 61967, 61968, 61969, 61970, 61971, 61972, 61973

Secunia: 38218

IAVA: 2010-A-0022

CWE: 94, 119