Description
Heap-based buffer overflow in RealPlayer 10 and earlier, Helix Player before 10.0.4, and RealOne Player v1 and v2 allows remote attackers to execute arbitrary code via a long hostname in a RAM file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | HelixPlayer | 1:1.0.4-1.1.EL4.2 | RHSA-2005:392 |
Advisories 1
- RHSA-2005:392 Red Hat Security Advisory: HelixPlayer security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2005:392 vendor-advisory
- RHSA-2005:363 vendor-advisory
- FEDORA-2005-329 vendor-advisory
- 20050420 RealNetworks RealPlayer/RealOne Player/Helix Player Remote Heap Overflow mailing-list
- http://service.real.com/help/faq/security/050419_player/EN/
- RHSA-2005:394 vendor-advisory
- oval:org.mitre.oval:def:11205 vdb-entry signature
- http://pb.specialised.info/all/adv/real-ram-adv.txt