CVE-2012-0926: Code Injection
Published Feb 8, 2012
·Updated
The RV10 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, does not properly handle height and width values, which allows remote attackers to execute arbitrary code via a crafted RV10 RealVideo video stream.
Affected Software
33 affected components
RealNetworks RealPlayer=14.0.0
RealNetworks RealPlayer=14.0.1
RealNetworks RealPlayer=14.0.1.609
RealNetworks RealPlayer=14.0.1.633
RealNetworks RealPlayer=14.0.2
RealNetworks RealPlayer=14.0.3
RealNetworks RealPlayer=14.0.4
RealNetworks RealPlayer=14.0.5
RealNetworks RealPlayer=14.0.6
RealNetworks RealPlayer=14.0.7
RealNetworks RealPlayer=11.0
RealNetworks RealPlayer=11.0.1
RealNetworks RealPlayer=11.0.2
RealNetworks RealPlayer=11.0.2.1744
RealNetworks RealPlayer=11.0.2.2315
RealNetworks RealPlayer=11.0.3
RealNetworks RealPlayer=11.0.4
RealNetworks RealPlayer=11.0.5
RealNetworks RealPlayer=11.1
RealNetworks RealPlayer=11.1.3
RealNetworks RealPlayer=11_build_6.0.14.748
RealNetworks RealPlayer=15.0.0
RealNetworks RealPlayer=15.0.1.13
RealNetworks RealPlayer SP=1.0.0
RealNetworks RealPlayer SP=1.0.1
RealNetworks RealPlayer SP=1.0.2
RealNetworks RealPlayer SP=1.0.5
RealNetworks RealPlayer SP=1.1
RealNetworks RealPlayer SP=1.1.1
RealNetworks RealPlayer SP=1.1.2
RealNetworks RealPlayer SP=1.1.3
RealNetworks RealPlayer SP=1.1.4
RealNetworks RealPlayer SP=1.1.5
Event History
Feb 8, 2012
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-0926?
CVE-2012-0926 has a CVSS score suggesting a medium severity level, allowing arbitrary code execution.
2
How do I fix CVE-2012-0926?
To fix CVE-2012-0926, update RealPlayer to version 15.02.71 or later.
3
Which versions of RealPlayer are affected by CVE-2012-0926?
CVE-2012-0926 affects RealPlayer versions 11.x, 14.x, and 15.x prior to 15.02.71.
4
What types of attacks can exploit CVE-2012-0926?
CVE-2012-0926 can be exploited through crafted RV10 RealVideo video streams to execute arbitrary code.
5
Is there a workaround for CVE-2012-0926 if I cannot update?
There are no known workarounds for CVE-2012-0926, so it's recommended to update to the latest version.