CVE-2006-6847: Medium severity RealNetworks RealPlayer vulnerability

Published Dec 31, 2006

Updated

An ActiveX control in ierpplug.dll for RealNetworks RealPlayer 10.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) by invoking the RealPlayer.OpenURLInPlayerBrowser method with a long second argument.

Affected Software

8 affected components

RealNetworks RealPlayer=10.5_6.0.12.1069

RealNetworks RealPlayer=10.5_6.0.12.1016_beta

RealNetworks RealPlayer=10.5_6.0.12.1053

RealNetworks RealPlayer=10.5_6.0.12.1056

RealNetworks RealPlayer=10.5_6.0.12.1235

RealNetworks RealPlayer=10.5_6.0.12.1059

RealNetworks RealPlayer=10.5

RealNetworks RealPlayer=10.5_6.0.12.1040

Event History

Dec 31, 2006

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Jan 3, 2007

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-6847?

CVE-2006-6847 is classified as a denial of service vulnerability that can cause crashes in Internet Explorer 7.

How do I fix CVE-2006-6847?

To mitigate CVE-2006-6847, update to a patched version of RealPlayer that addresses this vulnerability.

Which versions of RealPlayer are affected by CVE-2006-6847?

CVE-2006-6847 affects RealPlayer versions 10.5, including specific builds such as 10.5_6.0.12.1069 and several beta versions.

What causes the vulnerability CVE-2006-6847?

CVE-2006-6847 is triggered by invoking the RealPlayer.OpenURLInPlayerBrowser method with an excessively long argument.

Can CVE-2006-6847 be exploited remotely?

Yes, CVE-2006-6847 can be exploited remotely by attackers sending specially crafted requests to the affected RealPlayer component.