VulnerabilityModified
CVE-2007-2263
Heap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and possibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an SWF (Flash) file with malformed record headers.
HIGH 9.3EPSS 7.30%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Heap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and possibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an SWF (Flash) file with malformed record headers.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 7.30% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- realnetworks/realone player · realnetworks/realplayer · realnetworks/realplayer enterprise
- Source
- cve@mitre.org
References
- http://osvdb.org/38344
- http://secunia.com/advisories/27361Patch, Vendor Advisory
- http://service.real.com/realplayer/security/10252007_player/en/Patch
- http://www.attrition.org/pipermail/vim/2007-October/001841.html
- http://www.securityfocus.com/archive/1/483110/100/0/threaded
- http://www.securityfocus.com/bid/26214Patch
- http://www.securityfocus.com/bid/26284
- http://www.securitytracker.com/id?1018866
- http://www.vupen.com/english/advisories/2007/3628Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-061.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37436
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11432
- http://osvdb.org/38344
- http://secunia.com/advisories/27361Patch, Vendor Advisory
- http://service.real.com/realplayer/security/10252007_player/en/Patch
- http://www.attrition.org/pipermail/vim/2007-October/001841.html
- http://www.securityfocus.com/archive/1/483110/100/0/threaded
- http://www.securityfocus.com/bid/26214Patch
- http://www.securityfocus.com/bid/26284
- http://www.securitytracker.com/id?1018866
- http://www.vupen.com/english/advisories/2007/3628Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-061.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37436
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11432
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.