CVE-2007-5601
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 42.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 42.37% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- realnetworks/realplayer
- Source
- cret@cert.org
References
- http://secunia.com/advisories/27248Vendor Advisory
- http://service.real.com/realplayer/security/191007_player/en/
- http://www.infosecblog.org/2007/10/nasa-bans-ie.html
- http://www.kb.cert.org/vuls/id/871673US Government Resource
- http://www.securityfocus.com/bid/26130
- http://www.securitytracker.com/id?1018843
- http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html
- http://www.us-cert.gov/cas/techalerts/TA07-297A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/3548Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37280
- http://secunia.com/advisories/27248Vendor Advisory
- http://service.real.com/realplayer/security/191007_player/en/
- http://www.infosecblog.org/2007/10/nasa-bans-ie.html
- http://www.kb.cert.org/vuls/id/871673US Government Resource
- http://www.securityfocus.com/bid/26130
- http://www.securitytracker.com/id?1018843
- http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html
- http://www.us-cert.gov/cas/techalerts/TA07-297A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/3548Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37280
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.