CVE-2010-4396: Input Validation
First published: Tue Dec 14 2010(Updated: )
Cross-zone scripting vulnerability in the HandleAction method in a certain ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 allows remote attackers to inject arbitrary web script or HTML in the Local Zone by specifying a local file in a NavigateToURL action, as demonstrated by a local skin file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Realnetworks Realplayer | =11.0 | |
| Realnetworks Realplayer | =11.0.4 | |
| Realnetworks Realplayer | =11.0.2 | |
| Realnetworks Realplayer | =11.0.3 | |
| Realnetworks Realplayer | =11.0.5 | |
| Realnetworks Realplayer | =11.1 | |
| Realnetworks Realplayer | =11.0.1 | |
| Realnetworks Realplayer Sp | =1.0.1 | |
| Realnetworks Realplayer Sp | =1.1.5 | |
| Realnetworks Realplayer Sp | =1.1.3 | |
| Realnetworks Realplayer Sp | =1.0.0 | |
| Realnetworks Realplayer Sp | =1.0.2 | |
| Realnetworks Realplayer Sp | =1.1 | |
| Realnetworks Realplayer Sp | =1.1.2 | |
| Realnetworks Realplayer Sp | =1.1.4 | |
| Realnetworks Realplayer Sp | =1.1.1 | |
| Realnetworks Realplayer Sp | =1.0.5 | |
| Realnetworks Realplayer | =2.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-historical
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/realnetworks
- canonical/realnetworks realplayer
- version/realnetworks realplayer/11.0
- version/realnetworks realplayer/11.0.4
- version/realnetworks realplayer/11.0.2
- version/realnetworks realplayer/11.0.3
- version/realnetworks realplayer/11.0.5
- version/realnetworks realplayer/11.1
- version/realnetworks realplayer/11.0.1
- canonical/realnetworks realplayer sp
- version/realnetworks realplayer sp/1.0.1
- version/realnetworks realplayer sp/1.1.5
- version/realnetworks realplayer sp/1.1.3
- version/realnetworks realplayer sp/1.0.0
- version/realnetworks realplayer sp/1.0.2
- version/realnetworks realplayer sp/1.1
- version/realnetworks realplayer sp/1.1.2
- version/realnetworks realplayer sp/1.1.4
- version/realnetworks realplayer sp/1.1.1
- version/realnetworks realplayer sp/1.0.5
- version/realnetworks realplayer/2.1.2