CVE-2007-5601

CRITICO 9.3CVE-2007-5601 · Published 20/10/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
realplayer realnetworks	`= 10.0= 10.5= 11_beta`	No fix yet

Description

Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.

References

secunia.com/advisories/27248 · Vendor Advisory
service.real.com/realplayer/security/191007_player/en
infosecblog.org/2007/10/nasa-bans-ie.html
kb.cert.org/vuls/id/871673 · US Government Resource
securityfocus.com/bid/26130
securitytracker.com/id
symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html
us-cert.gov/cas/techalerts/TA07-297A.html · US Government Resource
vupen.com/english/advisories/2007/3548 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/37280

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free