CVE-2011-2948

Published: Aug 18, 2011Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.0 through 2.1.5, and Mac RealPlayer 12.0.0.1569 do not properly handle DEFINEFONT fields in SWF files, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted file.

Affected (24)

Products: Realnetworks: Realplayer, Realplayer Sp

Realnetworks

2 products

Realplayer

Realplayer Sp

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Realnetworks Realplayer	Version 11.0
Realnetworks Realplayer	Version 11.1

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Realnetworks Realplayer	Version 14.0.0
Realnetworks Realplayer	Version 14.0.1
Realnetworks Realplayer	Version 14.0.2
Realnetworks Realplayer	Version 14.0.3
Realnetworks Realplayer	Version 14.0.4
Realnetworks Realplayer	Version 14.0.5

Configuration C

10 vulnerable

Vulnerable Software	Affected Versions
Realnetworks Realplayer Sp	Version 1.0.0
Realnetworks Realplayer Sp	Version 1.0.1
Realnetworks Realplayer Sp	Version 1.0.2
Realnetworks Realplayer Sp	Version 1.0.5
Realnetworks Realplayer Sp	Version 1.1.1
Realnetworks Realplayer Sp	Version 1.1.2
Realnetworks Realplayer Sp	Version 1.1.3
Realnetworks Realplayer Sp	Version 1.1.4
Realnetworks Realplayer Sp	Version 1.1.5
Realnetworks Realplayer Sp	Version 1.1

Configuration D

6 vulnerable

Vulnerable Software	Affected Versions
Realnetworks Realplayer	Version 12.0.0.1569
Realnetworks Realplayer	Version 2.0
Realnetworks Realplayer	Version 2.1.2
Realnetworks Realplayer	Version 2.1.3
Realnetworks Realplayer	Version 2.1.4
Realnetworks Realplayer	Version 2.1.5