CVE-2011-0694: Critical severity realplayer vulnerability

Published Feb 21, 2011

Updated

RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.

Affected Software

19 affected components

RealNetworks RealPlayer=11.0

RealNetworks RealPlayer=11.1

RealNetworks RealPlayer=14.0.1

RealNetworks RealPlayer=14.0.0

RealNetworks RealPlayer SP=1.0.1

RealNetworks RealPlayer SP=1.1.5

RealNetworks RealPlayer SP=1.1.3

RealNetworks RealPlayer SP=1.0.0

RealNetworks RealPlayer SP=1.0.2

RealNetworks RealPlayer SP=1.1

RealNetworks RealPlayer SP=1.1.2

RealNetworks RealPlayer SP=1.1.4

RealNetworks RealPlayer SP=1.1.1

RealNetworks RealPlayer SP=1.0.5

RealNetworks RealPlayer=2.1

RealNetworks RealPlayer=2.1.3

RealNetworks RealPlayer=2.1.2

RealNetworks RealPlayer=2.0

RealNetworks RealPlayer=2.1.4

Event History

Feb 21, 2011

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-0694?

CVE-2011-0694 is classified as a medium-severity vulnerability that allows for cross-domain scripting attacks.

How do I fix CVE-2011-0694?

To fix CVE-2011-0694, users should update RealNetworks RealPlayer to the latest version available from the vendor.

What versions of RealPlayer are affected by CVE-2011-0694?

CVE-2011-0694 affects RealPlayer versions 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1.

What type of attack can be launched using CVE-2011-0694?

CVE-2011-0694 allows attackers to execute arbitrary code via cross-domain scripting attacks.

Is it safe to continue using software affected by CVE-2011-0694?

Continuing to use affected software without mitigation is risky and not recommended due to potential exploitation.