Vulnerability Details : CVE-2007-2263
Heap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and possibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an SWF (Flash) file with malformed record headers.
Vulnerability category: OverflowExecute code
Exploit prediction scoring system (EPSS) score for CVE-2007-2263
Probability of exploitation activity in the next 30 days: 95.63%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-2263
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2007-2263
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2007-2263
-
Red Hat 2007-11-01This issue was fixed in RealPlayer for Red Hat Enterprise Linux 3 Extras, 4 Extras, 5 Supplementary by RHSA-2007:0841 on 17th August 2007: http://rhn.redhat.com/errata/RHSA-2007-0841.html)on (Our original advisory did not mention this issue was fixed as the details of the issue were not made public by RealNetworks until 25th October 2007)
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/37436
- http://www.attrition.org/pipermail/vim/2007-October/001841.html
-
http://www.zerodayinitiative.com/advisories/ZDI-07-061.html
- http://www.securityfocus.com/bid/26214
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11432
- http://www.securitytracker.com/id?1018866
-
http://www.vupen.com/english/advisories/2007/3628
Vendor Advisory
-
http://www.securityfocus.com/archive/1/483110/100/0/threaded
- http://service.real.com/realplayer/security/10252007_player/en/
-
http://www.securityfocus.com/bid/26284
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.6:linux:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.7:linux:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1698:windows:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1741:windows:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:*:windows:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.8:linux:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.9:linux:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.0.352:mac:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.5:linux:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1040:windows:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.5:6.0.12.1578:windows:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.0.305:mac:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:10.0.0.331:mac:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.1:10.0.0.396:mac:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.1:10.0.0.412:mac:*:*:*:*:*
- cpe:2.3:a:realnetworks:realone_player:*:*:mac:en:*:*:*:*
- cpe:2.3:a:realnetworks:realone_player:2.0:*:windows:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:windows:en:*:*:*:*