CVE-2010-4385: Integer Overflow

Published Dec 14, 2010

Updated

Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to have an unspecified impact via crafted frame dimensions in an SIPR stream.

Affected Software

19 affected components

RealNetworks RealPlayer=11.0

RealNetworks RealPlayer=11.0.4

RealNetworks RealPlayer=11.0.2

RealNetworks RealPlayer=11.0.3

RealNetworks RealPlayer=11.0.5

RealNetworks RealPlayer=11.1

RealNetworks RealPlayer=11.0.1

RealNetworks RealPlayer SP=1.0.1

RealNetworks RealPlayer SP=1.1.3

RealNetworks RealPlayer SP=1.0.0

RealNetworks RealPlayer SP=1.0.2

RealNetworks RealPlayer SP=1.1

RealNetworks RealPlayer SP=1.1.2

RealNetworks RealPlayer SP=1.1.4

RealNetworks RealPlayer SP=1.1.1

RealNetworks RealPlayer SP=1.0.5

RealNetworks RealPlayer=2.1.2

RealNetworks RealPlayer=11.0.2.1744

Linux Linux kernel

Event History

Dec 14, 2010

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4385?

CVE-2010-4385 is considered to have a medium severity rating due to its potential to cause unspecified impact through an integer overflow.

How do I fix CVE-2010-4385?

To fix CVE-2010-4385, users should update RealPlayer to the latest version available from RealNetworks.

Which versions of RealPlayer are affected by CVE-2010-4385?

CVE-2010-4385 affects RealPlayer versions 11.0 through 11.1 and RealPlayer SP versions 1.0 through 1.1.4.

Can CVE-2010-4385 be exploited remotely?

Yes, CVE-2010-4385 can be exploited remotely via crafted frame dimensions.

Is there a patch available for CVE-2010-4385?

Yes, a patch is available and can be obtained by updating to the latest version of RealPlayer.