CVE-2011-1426: Critical severity realplayer vulnerability

Published Apr 18, 2011

Updated

The OpenURLInDefaultBrowser method in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2, and RealPlayer SP 1.0 through 1.1.5, launches a default handler for the filename specified in the first argument, which allows remote attackers to execute arbitrary code via a .rnx filename corresponding to a crafted RNX file.

Affected Software

15 affected components

RealNetworks RealPlayer=11.0

RealNetworks RealPlayer=11.1

RealNetworks RealPlayer=14.0.1

RealNetworks RealPlayer=14.0.2

RealNetworks RealPlayer=14.0.0

RealNetworks RealPlayer SP=1.0.1

RealNetworks RealPlayer SP=1.1.5

RealNetworks RealPlayer SP=1.1.3

RealNetworks RealPlayer SP=1.0.0

RealNetworks RealPlayer SP=1.0.2

RealNetworks RealPlayer SP=1.1

RealNetworks RealPlayer SP=1.1.2

RealNetworks RealPlayer SP=1.1.4

RealNetworks RealPlayer SP=1.1.1

RealNetworks RealPlayer SP=1.0.5

Event History

Apr 18, 2011

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-1426?

CVE-2011-1426 has a critical severity rating as it allows remote attackers to execute arbitrary code.

How do I fix CVE-2011-1426?

To fix CVE-2011-1426, you should update RealNetworks RealPlayer to the latest version available.

Which versions of RealPlayer are affected by CVE-2011-1426?

CVE-2011-1426 affects RealPlayer versions 11.0 through 11.1 and 14.0.0 through 14.0.2.

What kind of attack does CVE-2011-1426 enable?

CVE-2011-1426 enables remote code execution attacks via malicious .rnx files.

Are RealNetworks RealPlayer SP versions affected by CVE-2011-1426?

Yes, RealNetworks RealPlayer SP versions 1.0 through 1.1.5 are also affected by CVE-2011-1426.