CVE-2010-2998

Array index error in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.0.1 allows remote attackers to execute arbitrary code via malformed sample data in a RealMedia .IVR file, related to a "malformed IVR pointer index" issue.

Published: Oct 19, 2010
Updated: Apr 13, 2023
CVE: CVE-2010-2998
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
realnetworks / realplayer	11.0	11.0.x
realnetworks / realplayer	11.0.4	11.0.4.x
realnetworks / realplayer	11.0.2	11.0.2.x
realnetworks / realplayer	11.0.3	11.0.3.x
realnetworks / realplayer	11.0.5	11.0.5.x
realnetworks / realplayer	11.1	11.1.x
realnetworks / realplayer	11.0.1	11.0.1.x
realnetworks / realplayer_sp	1.0.1	1.0.1.x
realnetworks / realplayer_sp	1.0.0	1.0.0.x

http://service.real.com/realplayer/security/10152010_player/en/
http://www.securityfocus.com/bid/44144
http://www.zerodayinitiative.com/advisories/ZDI-10-209/

Vulnerability Database

289,871

CVE-2010-2998