CVE-2010-4388: Input Validation
The (1) Upsell.htm, (2) Main.html, and (3) Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended Local Machine Zone restrictions and load arbitrary ActiveX controls, via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4388?
CVE-2010-4388 has been rated as a high severity vulnerability due to its ability to allow code injection into the RealOneActiveXObject process.
How do I fix CVE-2010-4388?
To remediate CVE-2010-4388, you should upgrade to a newer version of RealPlayer that is not affected by this vulnerability.
What versions of RealPlayer are affected by CVE-2010-4388?
CVE-2010-4388 affects RealPlayer versions 11.0 through 11.1, RealPlayer SP versions 1.0 through 1.1.5, and RealPlayer Enterprise versions 2.1.2 and 2.1.3.
What kind of attacks can exploit CVE-2010-4388?
CVE-2010-4388 can be exploited by remote attackers to inject malicious code into the vulnerable application.
Is CVE-2010-4388 related to ActiveX vulnerabilities?
Yes, CVE-2010-4388 specifically involves the RealOneActiveXObject process, which is a known vector for ActiveX vulnerabilities.