Evil-DB LogoEvil-DB
← All CVEs

CVE-2013-7260

high · 7.5

Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877.

7.5
CVSS
66.9%
EPSS (exploit prob.)
99th
EPSS percentile
2014-01-03
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-119

Affected products

VendorProductAffected versions
realnetworksrealplayer<= 17.0.4.60
realnetworksrealplayer2.1.2
realnetworksrealplayer2.1.3
realnetworksrealplayer2.1.4
realnetworksrealplayer4
realnetworksrealplayer5
realnetworksrealplayer6
realnetworksrealplayer7
realnetworksrealplayer8
realnetworksrealplayer10.0
realnetworksrealplayer10.5
realnetworksrealplayer11.0
realnetworksrealplayer11.0.1
realnetworksrealplayer11.0.2
realnetworksrealplayer11.0.2.1744
realnetworksrealplayer11.0.2.2315
realnetworksrealplayer11.0.3
realnetworksrealplayer11.0.4
realnetworksrealplayer11.0.5
realnetworksrealplayer11.1
realnetworksrealplayer11.1.3
realnetworksrealplayer11_build_6.0.14.748
realnetworksrealplayer12.0.0.1444
realnetworksrealplayer12.0.0.1548
realnetworksrealplayer14.0.0
realnetworksrealplayer14.0.1
realnetworksrealplayer14.0.1.609
realnetworksrealplayer14.0.2
realnetworksrealplayer14.0.3
realnetworksrealplayer14.0.4
realnetworksrealplayer14.0.5
realnetworksrealplayer15.0.0
realnetworksrealplayer15.0.4
realnetworksrealplayer15.0.4.43
realnetworksrealplayer15.0.5.109
realnetworksrealplayer15.0.6.14
realnetworksrealplayer15.02.71
realnetworksrealplayer16.0.0
realnetworksrealplayer16.0.0.282
realnetworksrealplayer16.0.1.18

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-7260