First published: Wed Sep 29 2004(Updated: )
Directory traversal vulnerability in RealPlayer 10.5 (6.0.12.1040) and earlier allows remote attackers to delete arbitrary files via a Real Metadata Packages (RMP) file with a FILENAME tag containing .. (dot dot) sequences in a filename that ends with a ? (question mark) and an allowed file extension (e.g. .mp3), which bypasses the check for the file extension.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Realnetworks Realplayer | =10.5_6.0.12.1016_beta | |
Realnetworks Realone Player | =2.0 | |
Realnetworks Realplayer | =10.0_beta | |
Realnetworks Realone Player | =1.0 | |
Realnetworks Realplayer | =10.0_6.0.12.690 | |
Realnetworks Realplayer | =10.5 | |
Realnetworks Realplayer | =10.5_6.0.12.1040 | |
Realnetworks Realplayer | =10.0 | |
Realnetworks Realplayer | =10.0 | |
Realnetworks Realplayer | =10.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.