CVE-2008-1309
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 46.0%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 45.95% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- realnetworks/realplayer
- Source
- cve@mitre.org
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060659.html
- http://secunia.com/advisories/29315Vendor Advisory
- http://service.real.com/realplayer/security/07252008_player/en/Vendor Advisory
- http://www.kb.cert.org/vuls/id/831457US Government Resource
- http://www.securityfocus.com/archive/1/494779/100/0/threaded
- http://www.securityfocus.com/bid/28157Exploit
- http://www.securitytracker.com/id?1019576
- http://www.securitytracker.com/id?1020563
- http://www.vupen.com/english/advisories/2008/0842Vendor Advisory
- http://www.vupen.com/english/advisories/2008/2194/referencesVendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-047/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41087
- https://www.exploit-db.com/exploits/5332
- http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060659.html
- http://secunia.com/advisories/29315Vendor Advisory
- http://service.real.com/realplayer/security/07252008_player/en/Vendor Advisory
- http://www.kb.cert.org/vuls/id/831457US Government Resource
- http://www.securityfocus.com/archive/1/494779/100/0/threaded
- http://www.securityfocus.com/bid/28157Exploit
- http://www.securitytracker.com/id?1019576
- http://www.securitytracker.com/id?1020563
- http://www.vupen.com/english/advisories/2008/0842Vendor Advisory
- http://www.vupen.com/english/advisories/2008/2194/referencesVendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-047/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41087
- https://www.exploit-db.com/exploits/5332
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.