CVE-2010-2999

Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed MLLT atom in an AAC file.

Published: Dec 14, 2010
Updated: Apr 13, 2023
CVE: CVE-2010-2999
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C

CWEs:

CWE-189

Affected Software
References

Software	From	Fixed in
realnetworks / realplayer	11.0	11.0.x
realnetworks / realplayer	11.0.4	11.0.4.x
realnetworks / realplayer	11.0.2	11.0.2.x
realnetworks / realplayer	11.0.3	11.0.3.x
realnetworks / realplayer	11.0.5	11.0.5.x
realnetworks / realplayer	11.1	11.1.x
realnetworks / realplayer	11.0.1	11.0.1.x
realnetworks / realplayer_sp	1.0.1	1.0.1.x
realnetworks / realplayer_sp	1.0.0	1.0.0.x
realnetworks / realplayer	11.0.2.1744	11.0.2.1744.x

http://service.real.com/realplayer/security/12102010_player/en/
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-273

Vulnerability Database

289,871

CVE-2010-2999