VulnerabilityModified

CVE-2009-4244

HIGH 9.3EPSS 7.26%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (7.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via an SIPR codec field with a small length value that triggers incorrect memory allocation.

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 7.26% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: realnetworks/realplayer · realnetworks/realplayer enterprise · realnetworks/realplayer sp · realnetworks/helix player
Source: cve@mitre.org

References

http://secunia.com/advisories/38218Vendor Advisory
http://securitytracker.com/id?1023489Patch
http://service.real.com/realplayer/security/01192010_player/en/Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/509098/100/0/threaded
http://www.securityfocus.com/bid/37880
http://www.vupen.com/english/advisories/2010/0178Patch, Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-008/Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/55797
http://secunia.com/advisories/38218Vendor Advisory
http://securitytracker.com/id?1023489Patch
http://service.real.com/realplayer/security/01192010_player/en/Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/509098/100/0/threaded
http://www.securityfocus.com/bid/37880
http://www.vupen.com/english/advisories/2010/0178Patch, Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-008/Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/55797

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.