CVE-2010-4378: Buffer Overflow

Published Dec 14, 2010

Updated

The drv2.dll (aka RV20 decompression) module in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.1.2 and 2.1.3, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted value of an unspecified length field in an RV20 video stream.

Affected Software

21 affected components

RealNetworks RealPlayer=11.0

RealNetworks RealPlayer=11.0.4

RealNetworks RealPlayer=11.0.2

RealNetworks RealPlayer=11.0.3

RealNetworks RealPlayer=11.0.5

RealNetworks RealPlayer=11.1

RealNetworks RealPlayer=11.0.1

RealNetworks RealPlayer SP=1.0.1

RealNetworks RealPlayer SP=1.1.5

RealNetworks RealPlayer SP=1.1.3

RealNetworks RealPlayer SP=1.0.0

RealNetworks RealPlayer SP=1.0.2

RealNetworks RealPlayer SP=1.1

RealNetworks RealPlayer SP=1.1.2

RealNetworks RealPlayer SP=1.1.4

RealNetworks RealPlayer SP=1.1.1

RealNetworks RealPlayer SP=1.0.5

RealNetworks RealPlayer=2.1.3

RealNetworks RealPlayer=2.1.2

RealNetworks RealPlayer=11.0.2.1744

Linux Linux kernel

Event History

Dec 14, 2010

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4378?

CVE-2010-4378 is classified as a high-severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2010-4378?

To mitigate CVE-2010-4378, users should update RealPlayer to the latest version provided by RealNetworks.

Which versions are affected by CVE-2010-4378?

CVE-2010-4378 affects RealPlayer versions 11.0 through 11.1, as well as RealPlayer SP versions 1.0 through 1.1.5.

Can CVE-2010-4378 be exploited remotely?

Yes, CVE-2010-4378 can be exploited remotely by attackers to execute arbitrary code.

What software does CVE-2010-4378 impact?

CVE-2010-4378 impacts RealNetworks RealPlayer and RealPlayer SP software.