Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
RealPlayer is vulnerable to a buffer overflow allowing for the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200809-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Buffer overflow Date: September 04, 2008 Bugs: #232997 ID: 200809-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a buffer overflow allowing for the execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 11.0.0.4028-r1 > = 11.0.0.4028-r1 Description ========== Dyon Balding of Secunia Research reported an unspecified heap-based buffer overflow in the Shockwave Flash (SWF) frame handling. Impact ===== By enticing a user to open a specially crafted SWF (Shockwave Flash) file, a remote attacker could be able to execute arbitrary code with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-11.0.0.4028-r1" References ========= [ 1 ] CVE-2007-5400 https://www.cve.org/CVERecord?id=CVE-2007-5400 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200809-03 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
RealPlayer is vulnerable to a buffer overflow allowing for execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200709-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Buffer overflow Date: September 14, 2007 Bugs: #183421 ID: 200709-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a buffer overflow allowing for execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.9 > = 10.0.9 Description ========== A stack-based buffer overflow vulnerability has been reported in the SmilTimeValue::parseWallClockValue() function in smlprstime.cpp when handling HH:mm:ss.f type time formats. Impact ===== By enticing a user to open a specially crafted SMIL (Synchronized Multimedia Integration Language) file, an attacker could be able to execute arbitrary code with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.9" References ========= [ 1 ] CVE-2007-3410 https://www.cve.org/CVERecord?id=CVE-2007-3410 Availability =========== This GLSA and any updates to it are available forviewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200709-05 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
RealPlayer is vulnerable to a buffer overflow that could lead to remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200603-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Buffer overflow vulnerability Date: March 26, 2006 Bugs: #127352 ID: 200603-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a buffer overflow that could lead to remote execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.7 > = 10.0.7 Description ========== RealPlayer is vulnerable to a buffer overflow when processing malicious SWF files. Impact ===== By enticing a user to open a specially crafted SWF file an attacker could execute arbitrary code with the permissions of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.7" References ========= [ 1 ] CVE-2006-0323 https://www.cve.org/CVERecord?id=CVE-2006-0323 [ 2 ] RealNetworks Advisory https://www.real.com/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200603-24 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
This update fixes the following security problems in Realplayer: This update fixes the following security problems in Realplayer: - Specially crafted SWF files could cause a buffer overflow andcrash RealPlayer (CVE-2006-0323). - Specially crafted web sites could cause heap overflow and lead toexecuting arbitrary code (CVE-2005-2922). This was already fixedwith the previously released 1.0.6 versi [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: RealPlayer Announcement ID: SUSE-SA:2006:018 Date: Thu, 23 Mar 2006 12:00:00 +0000 Affected Products: Novell Linux Desktop 9 SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE Default Package: yes Cross-References: CVE-2005-2922, CVE-2006-0323 Content of This Advisory: 1) Security Vulnerability Resolved: realplayer security problems Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update fixes the following security problems in Realplayer: - Specially crafted SWF files could cause a buffer overflow and crash RealPlayer (CVE-2006-0323). - Specially crafted web sites could cause heap overflow and lead to executing arbitrary code (CVE-2005-2922). This was already fixed with the previouslyreleased 1.0.6 version, but not announced on request of Real. The advisory for these problems is on this page at Real: https://www.real.com/ SUSE Linux 9.2 up to 10.0 and Novell Linux Desktop 9 are affected by this problem and receive fixed packages. If you are still using Realplayer on SUSE Linux 9.1 or SUSE Linux Desktop 1, we again wish to remind you that the Real player on these products cannot be updated and recommend to deinstall it. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: eaf09598db97183bdb25478dc5266edf SUSE LINUX 9.3: 427de6f3af871dca3d9c6c4f42d14793 SUSE LINUX 9.2: e84dd17634bcb046ade69fcdc8d67468 Sources: SUSE LINUX 10.0: d686f982312d06ff76ad786c29c94f5a SUSE LINUX 9.3: 5355bf3f17801d07f9a004711622dc8e SUSE LINUX 9.2: 0a7e783c563c24107b04b7f7f4e0b697 Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification andAdditional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
An updated RealPlayer package that fixes a format string bug is now available. This update has been rated as having critical security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: RealPlayer security update Advisory ID: RHSA-2005:762-02 Advisory URL: https://access.redhat.com/errata/RHSA-2005:762.html Issue date: 2005-09-27 Updated on: 2005-09-27 Product: Red Hat Enterprise Linux Extras CVE Names: CAN-2005-2710 - ---------------------------------------------------------------------1. Summary: An updated RealPlayer package that fixes a format string bug is now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 Extras - i386, x86_64 Red Hat Desktop version 3 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 3 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 3 Extras - i386, x86_64 Red Hat Enterprise Linux AS version 4 Extras - i386, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64 3. Problem description: RealPlayer is a media player that provides media playback locally and via streaming. A format string bug was discovered in the way RealPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running RealPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2710 to this issue. All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.6 and is not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previouslyreleased errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 167891 - CAN-2005-2710 Format String Flaw 6. RPMs required: Red Hat Enterprise Linux AS version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Desktop version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Enterprise Linux ES version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Enterprise Linux WS version 3 Extras: i386: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm x86_64: 8e82aeea9827c8a6fcafea04ca3a21de realplayer-10.0.6-0.rhel3.2.i386.rpm Red Hat Enterprise Linux AS version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm Red Hat Desktop version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm Red Hat Enterprise Linux ES version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm Red Hat Enterprise Linux WS version 4 Extras: i386: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm x86_64: fbde4c12e6ef6fa97db36f83e5a0feac RealPlayer-10.0.6-2.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CAN-2005-2710 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2005 Red Hat, Inc. . Important QuickTime patch for Debian resolves a code execution vulnerability posing significant risk. Update without delay.. RealPlayer Security, Red Hat Updates, Format String Patch. . Severity: Critical. LinuxSecurity.com Team
RealPlayer is vulnerable to a heap overflow that could lead to remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200507-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer: Heap overflow vulnerability Date: July 06, 2005 Bugs: #96923 ID: 200507-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer is vulnerable to a heap overflow that could lead to remote execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.5 > = 10.0.5 Description ========== RealPlayer is vulnerable to a heap overflow when opening RealMedia files which make use of RealText. Impact ===== By enticing a user to play a specially crafted RealMedia file an attacker could execute arbitrary code with the permissions of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer users should upgrade to the latest available version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.5" References ========= [ 1 ] RealNetworks Security Advisory https://www.real.com/ [ 2 ] CAN-2005-1766 https://www.cve.org/CVERecord?id=CVE-CAN-2005-1766 Availability =========== This GLSA and any updates to it are available for viewing at the GentooSecurity Website: https://security.gentoo.org/glsa/200507-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
RealPlayer and Helix Player are vulnerable to a buffer overflow that could lead to remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200504-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RealPlayer, Helix Player: Buffer overflow vulnerability Date: April 22, 2005 Bugs: #89862 ID: 200504-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= RealPlayer and Helix Player are vulnerable to a buffer overflow that could lead to remote execution of arbitrary code. Background ========= RealPlayer is a multimedia player capable of handling multiple multimedia file formats. Helix Player is the Open Source version of RealPlayer. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/realplayer < 10.0.4 > = 10.0.4 2 media-video/helixplayer < 1.0.4 > = 1.0.4 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Piotr Bania has discovered a buffer overflow vulnerability in RealPlayer and Helix Player when processing malicious RAM files. Impact ===== By enticing a user to play a specially crafted RAM file an attacker could execute arbitrary code with the permissions of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All RealPlayer usersshould upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/realplayer-10.0.4" All Helix Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-video/helixplayer-1.0.4" References ========= [ 1 ] CAN-2005-0755 https://www.cve.org/CVERecord?id=CAN-2005-0755 [ 2 ] RealNetworks Advisory https://www.real.com/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200504-21 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Updated realplayer packages that fix a number of security issues are now available for Red Hat Enterprise Linux 3 Extras. This update has been rated as having important security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: realplayer security update Advisory ID: RHSA-2005:299-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:299.html Issue date: 2005-03-21 Updated on: 2005-03-21 Product: Red Hat Enterprise Linux Extras Keywords: LACD - ---------------------------------------------------------------------1. Summary: Updated realplayer packages that fix a number of security issues are now available for Red Hat Enterprise Linux 3 Extras. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 Extras - i386 Red Hat Desktop version 3 Extras - i386 Red Hat Enterprise Linux ES version 3 Extras - i386 Red Hat Enterprise Linux WS version 3 Extras - i386 3. Problem description: The realplayer package contains RealPlayer, a media format player. A number of security issues have been discovered in RealPlayer 8 of which a subset are believed to affect the Linux version as shipped with Red Hat Enterprise Linux 3 Extras. RealPlayer 8 is no longer supported by RealNetworks. Users of RealPlayer are advised to upgrade to this erratum package which contains RealPlayer 10. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration orCustomization guide specific to your system: 5. Bug IDs fixed (http://bugzilla.redhat.com/): 150341 - RHEL3 U5: Update to RealPlayer 10 6. RPMs required: Red Hat Enterprise Linux AS version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm Red Hat Desktop version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm Red Hat Enterprise Linux ES version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm Red Hat Enterprise Linux WS version 3 Extras: i386: ba5814b72fd7f0c4838fd628d6d9ec2b realplayer-10.0.3-1.rhel3.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. . Crucial security patch released for Red Hat Enterprise Linux 3 Extras to mitigate potential threats.. RedHat Security, RealPlayer, MediaPlayerUpdate, ImportantAdvisories, LinuxFixes. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.