Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 418
Alerts This Week
Warning Icon 1 418

Stay Secure with the Latest Linux Advisories

Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":3,"type":"x","order":2,"pct":60,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":2,"type":"x","order":4,"pct":40,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -1 articles for you...
91

Gentoo: 200809-03 Normal: RealPlayer Buffer Overflow Threat

RealPlayer is vulnerable to a buffer overflow allowing for the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200809-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Buffer overflow Date: September 04, 2008 Bugs: #232997 ID: 200809-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a buffer overflow allowing for the execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 11.0.0.4028-r1 > = 11.0.0.4028-r1 Description ========== Dyon Balding of Secunia Research reported an unspecified heap-based buffer overflow in the Shockwave Flash (SWF) frame handling. Impact ===== By enticing a user to open a specially crafted SWF (Shockwave Flash) file, a remote attacker could be able to execute arbitrary code with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-11.0.0.4028-r1" References ========= [ 1 ] CVE-2007-5400 https://www.cve.org/CVERecord?id=CVE-2007-5400 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200809-03 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2008 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . RealPlayer on Gentoo Linux susceptible to stack overflow; imperative to update for mitigation against remote command execution threats.. RealPlayer Overflow, Gentoo Security Advisory, Multimedia Threats. . LinuxSecurity.com Team

Calendar%202 Sep 04, 2008 Gentoo
91

Gentoo: GLSA-200709-05 Normal: RealPlayer Buffer Overflow Threat

RealPlayer is vulnerable to a buffer overflow allowing for execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200709-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Buffer overflow Date: September 14, 2007 Bugs: #183421 ID: 200709-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a buffer overflow allowing for execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.9 > = 10.0.9 Description ========== A stack-based buffer overflow vulnerability has been reported in the SmilTimeValue::parseWallClockValue() function in smlprstime.cpp when handling HH:mm:ss.f type time formats. Impact ===== By enticing a user to open a specially crafted SMIL (Synchronized Multimedia Integration Language) file, an attacker could be able to execute arbitrary code with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.9" References ========= [ 1 ] CVE-2007-3410 https://www.cve.org/CVERecord?id=CVE-2007-3410 Availability =========== This GLSA and any updates to it are available forviewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200709-05 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Gentoo GLSA 202310-04: VLC media player users need to update to address a security flaw that could lead to unauthorized system access.. RealPlayer, buffer overflow, Gentoo advisory, execution risk, software update. . LinuxSecurity.com Team

Calendar%202 Sep 14, 2007 Gentoo
91

Gentoo: GLSA-200603-24 Critical: RealPlayer Buffer Overflow Attack

RealPlayer is vulnerable to a buffer overflow that could lead to remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200603-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Buffer overflow vulnerability Date: March 26, 2006 Bugs: #127352 ID: 200603-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a buffer overflow that could lead to remote execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.7 > = 10.0.7 Description ========== RealPlayer is vulnerable to a buffer overflow when processing malicious SWF files. Impact ===== By enticing a user to open a specially crafted SWF file an attacker could execute arbitrary code with the permissions of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.7" References ========= [ 1 ] CVE-2006-0323 https://www.cve.org/CVERecord?id=CVE-2006-0323 [ 2 ] RealNetworks Advisory https://www.real.com/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200603-24 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.0/ . Ubuntu Security Notice USN-1234-1 discusses a vulnerability in VLC Media Player that could lead to unauthorized access to system resources.. RealPlayer Vulnerability,Gentoo Buffer Overflow,Remote Execution. . LinuxSecurity.com Team

Calendar%202 Mar 26, 2006 Gentoo
100

SUSE: 2006-018 Critical: RealPlayer Remote Code Execution Threat

This update fixes the following security problems in Realplayer: This update fixes the following security problems in Realplayer: - Specially crafted SWF files could cause a buffer overflow andcrash RealPlayer (CVE-2006-0323). - Specially crafted web sites could cause heap overflow and lead toexecuting arbitrary code (CVE-2005-2922). This was already fixedwith the previously released 1.0.6 versi [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: RealPlayer Announcement ID: SUSE-SA:2006:018 Date: Thu, 23 Mar 2006 12:00:00 +0000 Affected Products: Novell Linux Desktop 9 SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE Default Package: yes Cross-References: CVE-2005-2922, CVE-2006-0323 Content of This Advisory: 1) Security Vulnerability Resolved: realplayer security problems Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update fixes the following security problems in Realplayer: - Specially crafted SWF files could cause a buffer overflow and crash RealPlayer (CVE-2006-0323). - Specially crafted web sites could cause heap overflow and lead to executing arbitrary code (CVE-2005-2922). This was already fixed with the previouslyreleased 1.0.6 version, but not announced on request of Real. The advisory for these problems is on this page at Real: https://www.real.com/ SUSE Linux 9.2 up to 10.0 and Novell Linux Desktop 9 are affected by this problem and receive fixed packages. If you are still using Realplayer on SUSE Linux 9.1 or SUSE Linux Desktop 1, we again wish to remind you that the Real player on these products cannot be updated and recommend to deinstall it. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: eaf09598db97183bdb25478dc5266edf SUSE LINUX 9.3: 427de6f3af871dca3d9c6c4f42d14793 SUSE LINUX 9.2: e84dd17634bcb046ade69fcdc8d67468 Sources: SUSE LINUX 10.0: d686f982312d06ff76ad786c29c94f5a SUSE LINUX 9.3: 5355bf3f17801d07f9a004711622dc8e SUSE LINUX 9.2: 0a7e783c563c24107b04b7f7f4e0b697 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification andAdditional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from This email address is being protected from spambots. You need JavaScript enabled to view it. with the key ID 9C800ACA. This key isautomatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. 2) If you need an alternative means of verification, use the md5sum command to verify the authenticity of the packages. Execute the command md5sum after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by This email address is being protected from spambots. You need JavaScript enabled to view it.), the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified. - SUSE runs two security mailing lists to which any interested party may subscribe: This email address is being protected from spambots. You need JavaScript enabled to view it. - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to . This email address is being protected from spambots. You need JavaScript enabled to view it. - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to . For general information or the frequently asked questions (FAQ), send mail to or . ==================================================================== SUSE's security contact is or . The public key is listed below. ==================================================================== . This memo discusses vulnerabilities in VLC Media Player, emphasizing stack and memory corruption threats along with their mitigations.. RealPlayer Security,SUSE LinuxUpdate,Remote Code Execution,Buffer Overflow Fix. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Mar 23, 2006 Critical SuSE
98

Red Hat: RHSA-2005:762-02 Critical: RealPlayer Format String Issue

An updated RealPlayer package that fixes a format string bug is now available. This update has been rated as having critical security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: RealPlayer security update Advisory ID: RHSA-2005:762-02 Advisory URL: https://access.redhat.com/errata/RHSA-2005:762.html Issue date: 2005-09-27 Updated on: 2005-09-27 Product: Red Hat Enterprise Linux Extras CVE Names: CAN-2005-2710 - ---------------------------------------------------------------------1. Summary: An updated RealPlayer package that fixes a format string bug is now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 Extras - i386, x86_64 Red Hat Desktop version 3 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 3 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 3 Extras - i386, x86_64 Red Hat Enterprise Linux AS version 4 Extras - i386, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64 3. Problem description: RealPlayer is a media player that provides media playback locally and via streaming. A format string bug was discovered in the way RealPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running RealPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2710 to this issue. All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.6 and is not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previouslyreleased errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 167891 - CAN-2005-2710 Format String Flaw 6. RPMs required: Red Hat Enterprise Linux AS version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Desktop version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Enterprise Linux ES version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Enterprise Linux WS version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Enterprise Linux AS version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm Red Hat Desktop version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm Red Hat Enterprise Linux ES version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm Red Hat Enterprise Linux WS version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CAN-2005-2710 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2005 Red Hat, Inc. . Important QuickTime patch for Debian resolves a code execution vulnerability posing significant risk. Update without delay.. RealPlayer Security, Red Hat Updates, Format String Patch. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Sep 27, 2005 Critical Red Hat
91

Debian: DSA-2005-123 Severe: VLC Media Player Buffer Underflow Threat

RealPlayer is vulnerable to a heap overflow that could lead to remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200507-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Heap overflow vulnerability Date: July 06, 2005 Bugs: #96923 ID: 200507-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a heap overflow that could lead to remote execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.5 > = 10.0.5 Description ========== RealPlayer is vulnerable to a heap overflow when opening RealMedia files which make use of RealText. Impact ===== By enticing a user to play a specially crafted RealMedia file an attacker could execute arbitrary code with the permissions of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest available version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.5" References ========= [ 1 ] RealNetworks Security Advisory https://www.real.com/ [ 2 ] CAN-2005-1766 https://www.cve.org/CVERecord?id=CVE-CAN-2005-1766 Availability =========== This GLSA and any updates to it are available for viewing at the GentooSecurity Website: https://security.gentoo.org/glsa/200507-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.0/ . VLC Media Player has an SQL injection flaw. Patch to mitigate unauthorized data access threats on Arch Linux distributions.. realplayer, heap overflow, remote execution, gentoo security, software update. . LinuxSecurity.com Team

Calendar%202 Jul 06, 2005 Gentoo
91

Gentoo: 200504-21 Normal Severity: RealPlayer Buffer Overflow

RealPlayer and Helix Player are vulnerable to a buffer overflow that could lead to remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200504-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer, Helix Player: Buffer overflow vulnerability Date: April 22, 2005 Bugs: #89862 ID: 200504-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer and Helix Player are vulnerable to a buffer overflow that could lead to remote execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Helix Player is the Open Source version of RealPlayer. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.4 > = 10.0.4 2 media-video/helixplayer < 1.0.4 > = 1.0.4 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Piotr Bania has discovered a buffer overflow vulnerability in RealPlayer and Helix Player when processing malicious RAM files. Impact ===== By enticing a user to play a specially crafted RAM file an attacker could execute arbitrary code with the permissions of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer usersshould upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.4" All Helix Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/helixplayer-1.0.4" References ========= [ 1 ] CAN-2005-0755 https://www.cve.org/CVERecord?id=CAN-2005-0755 [ 2 ] RealNetworks Advisory https://www.real.com/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200504-21 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.0/ . Both RealPlayer and Helix Player on Gentoo systems are vulnerable to a critical buffer overflow flaw, which may allow for remote code execution. Ensure you update your software immediately!. RealPlayer, Helix Player, Buffer Overflow, Remote Execution, Gentoo Security. . LinuxSecurity.com Team

Calendar%202 Apr 22, 2005 Gentoo
98

Red Hat Enterprise Linux 3: RHSA-2005:299-01 Important RealPlayer Update

Updated realplayer packages that fix a number of security issues are now available for Red Hat Enterprise Linux 3 Extras. This update has been rated as having important security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: realplayer security update Advisory ID: RHSA-2005:299-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:299.html Issue date: 2005-03-21 Updated on: 2005-03-21 Product: Red Hat Enterprise Linux Extras Keywords: LACD - ---------------------------------------------------------------------1. Summary: Updated realplayer packages that fix a number of security issues are now available for Red Hat Enterprise Linux 3 Extras. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 Extras - i386 Red Hat Desktop version 3 Extras - i386 Red Hat Enterprise Linux ES version 3 Extras - i386 Red Hat Enterprise Linux WS version 3 Extras - i386 3. Problem description: The realplayer package contains RealPlayer, a media format player. A number of security issues have been discovered in RealPlayer 8 of which a subset are believed to affect the Linux version as shipped with Red Hat Enterprise Linux 3 Extras. RealPlayer 8 is no longer supported by RealNetworks. Users of RealPlayer are advised to upgrade to this erratum package which contains RealPlayer 10. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration orCustomization guide specific to your system: 5. Bug IDs fixed (http://bugzilla.redhat.com/): 150341 - RHEL3 U5: Update to RealPlayer 10 6. RPMs required: Red Hat Enterprise Linux AS version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm Red Hat Desktop version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm Red Hat Enterprise Linux ES version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm Red Hat Enterprise Linux WS version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. . Crucial security patch released for Red Hat Enterprise Linux 3 Extras to mitigate potential threats.. RedHat Security, RealPlayer, MediaPlayerUpdate, ImportantAdvisories, LinuxFixes. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 21, 2005 Important Red Hat
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":3,"type":"x","order":2,"pct":60,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":2,"type":"x","order":4,"pct":40,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200