CVE-2010-3747
high · 9.3An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and application crash) via a long URI.
9.3
CVSS
34.8%
EPSS (exploit prob.)
98th
EPSS percentile
2010-10-19
Published
AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-119
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| realnetworks | realplayer | 11.0 |
| realnetworks | realplayer | 11.0.1 |
| realnetworks | realplayer | 11.0.2 |
| realnetworks | realplayer | 11.0.3 |
| realnetworks | realplayer | 11.0.4 |
| realnetworks | realplayer | 11.0.5 |
| realnetworks | realplayer | 11.1 |
| realnetworks | realplayer_sp | 1.0.0 |
| realnetworks | realplayer_sp | 1.0.1 |
| realnetworks | realplayer_sp | 1.0.2 |
| realnetworks | realplayer_sp | 1.0.5 |
| realnetworks | realplayer_sp | 1.1 |
| realnetworks | realplayer_sp | 1.1.1 |
| realnetworks | realplayer_sp | 1.1.2 |
| realnetworks | realplayer_sp | 1.1.3 |
| realnetworks | realplayer_sp | 1.1.4 |
| realnetworks | realplayer | 2.1.2 |
Check a specific version with /api/v1/cve/match.
References
- http://securityreason.com/securityalert/8147
- http://service.real.com/realplayer/security/10152010_player/en/
- http://www.securityfocus.com/bid/44144
- http://www.zerodayinitiative.com/advisories/ZDI-10-210/
- http://securityreason.com/securityalert/8147
- http://service.real.com/realplayer/security/10152010_player/en/
- http://www.securityfocus.com/bid/44144
- http://www.zerodayinitiative.com/advisories/ZDI-10-210/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2010-3747