Description
Heap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and possibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an SWF (Flash) file with malformed record headers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | RealPlayer | 10.0.9-3.el5 | RHSA-2007:0841 |
| RHEL 3 | realplayer | 10.0.9-0.rhel3.4 | RHSA-2007:0841 |
Advisories 1
- RHSA-2007:0841 Red Hat Security Advisory: RealPlayer security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://service.real.com/realplayer/security/10252007_player/en/
- http://www.zerodayinitiative.com/advisories/ZDI-07-061.html
- 38344 vdb-entry
- realplayer-swf-bo(37436) vdb-entry
- oval:org.mitre.oval:def:11432 vdb-entry signature
- 20071031 ZDI-07-061: RealNetworks RealPlayer SWF Processing Remote Code Execution Vulnerability mailing-list
- 1018866 vdb-entry
- 20071030 RealPlayer Updates of October 25, 2007 mailing-list
- ADV-2007-3628 vdb-entry
- 26284 vdb-entry
- 27361 third-party-advisory
- 26214 vdb-entry