CVE-2009-4246

Published: Jan 25, 2010Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file that contains a web.xmb file with crafted length values.

Affected (18)

Products: Realnetworks: Realplayer, Realplayer Enterprise, Realplayer Sp, Helix Player

Realnetworks

4 products

Realplayer

Realplayer Enterprise

Realplayer Sp

Helix Player

Configuration A

8 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Realnetworks Realplayer	Version 10.5
Realnetworks Realplayer	Version 11.0.2
Realnetworks Realplayer	Version 11.0.3
Realnetworks Realplayer	Version 11.0.4
Realnetworks Realplayer	Version 11.0.5
Realnetworks Realplayer Enterprise	All versions
Realnetworks Realplayer Sp	Version 1.0.0
Realnetworks Realplayer Sp	Version 1.0.1

Running on/with	Platform Versions
Microsoft Windows	All versions

Configuration B

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Realnetworks Realplayer	Version 10.0
Realnetworks Realplayer	Version 10.1
Realnetworks Realplayer	Version 11.0.1
Realnetworks Realplayer	Version 11.0

Running on/with	Platform Versions
Apple Mac Os X	All versions

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Realnetworks Helix Player	Version 10.0
Realnetworks Helix Player	Version 11.0.0
Realnetworks Helix Player	Version 11.0.1
Realnetworks Realplayer	Version 10.0
Realnetworks Realplayer	Version 11.0.0
Realnetworks Realplayer	Version 11.0.1