CVE-2010-3749: Code Injection
The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to arguments to the RecordClip method, which allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via a " (double quote) in an argument to the RecordClip method, aka "parameter injection."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3749?
CVE-2010-3749 is classified as a high severity vulnerability due to its ability to allow remote attackers to execute arbitrary programs on client machines.
How do I fix CVE-2010-3749?
To fix CVE-2010-3749, users should update to the latest version of RealPlayer that addresses this vulnerability.
Which versions of RealPlayer are affected by CVE-2010-3749?
CVE-2010-3749 affects RealPlayer versions 11.0 through 11.1 and RealPlayer SP versions 1.0 through 1.1.
What exploits are possible with CVE-2010-3749?
CVE-2010-3749 allows attackers to exploit the RecordClip method to remotely download and execute arbitrary programs on user systems.
Is there a patch available for CVE-2010-3749?
Yes, a patch is available from RealNetworks that resolves the issues introduced by CVE-2010-3749.