Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via vectors related to a modal dialog.

The remote host is running an application that is vulnerable to multiple attack vectors.

The remote host is running RealPlayer, a multi-media application. 

RealPlayer builds earlier than 12.0.1.666 are potentially affected by multiple code execution vulnerabilities :

  -  A heap based buffer overflow vulnerability exits within qcpfformat.dll file, which only creates a static 256 byte allocation on the heap. This can be abused by a remote attacker to execute arbitrary code running in the context of the web browser. (CVE-2011-2950)

  - A flaw exists due to RealPlayer allowing users to run local HTML files with scripting enabled without any warning. Attackers can exploit this issue to execute arbitrary code within the context of the application(typically Internet Explorer) that uses the ActiveX control. (CVE-2011-2947)

 - A memory-corruption vulnerability exist due to an use-after-free condition that affects "Embedded AutoUpdate." Successful exploit will allow remote attackers to execute arbitrary code within the context of the affected application. (CVE-2011-2954)

 - A remote buffer-overflow vulnerability exists due to the software failing to perform adequate boundary-checks on user-supplied data. Successful exploit allow attackers to execute arbitrary code in the context of the vulnerable applications. (CVE-2011-2951)

 - A remote code-execution vulnerability exists when handling 'DEFINEFONT' fields in Flash files. Successful exploit will allow remote attackers to execute arbitrary code within the context of the affected application. (CVE-2011-2948)

 - A remote code-execution vulnerability exist in the way the application uses 'WideCharToMultiByte' call, resulting in a heap-based buffer overflow. Successful exploit will allow remote attackers to execute arbitrary code within the context of the affected application. (CVE-2011-2949)

 - A memory-corruption vulnerability exists due to an use-after-free condition, particularly affects the dialogue box. Successful exploit will allow remote attackers to execute arbitrary code within the context of the affected application. (CVE-2011-2952)

\ - A memory-corruption vulnerability exists due to an use-after-free condition, particularly affects the Embedded Modal Dialog. Successful exploit will allow remote attackers to execute arbitrary code within the context of the affected application. (CVE-2011-2955)

 - A cross-zone scripting vulnerability exists due to the fact that the RealPlayer ActiveX control allows users to run local HTML files with scripting enabled without providing any warning. Attackers can exploit this issue to execute arbitrary code within the context of the application(typically Internet Explorer) that uses the ActiveX Control. (CVE-2011-121)


According to its build number, the installed version of RealPlayer on the remote Windows host is affected by multiple vulnerabilities :

  - A cross-zone scripting vulnerability exists in the     RealPlayer ActiveX control and can allow injection of     arbitrary web script or HTML in the 'Local Zone' via     a local HTML document. (CVE-2011-1221)

  - A heap-based buffer overflow exists in SIPR.
    (CVE-2011-2945)

  - A remote code execution vulnerability exists in the     ActiveX control. (CVE-2011-2946)

  - An unspecified cross-zone scripting remote code     execution vulnerability exists. (CVE-2011-2947)

  - A remote code execution vulnerability exists in SWF     DefineFont. (CVE-2011-2948)

  - A remote code execution vulnerability exists related to     MP3 ID3 tags. (CVE-2011-2949)

  - A remote code execution vulnerability exists in QCP     parsing. (CVE-2011-2950)

  - A remote code execution vulnerability exists in the     Advanced Audio Coding Element. (CVE-2011-2951)

  - A use-after-free vulnerability exists relating to dialog     boxes. (CVE-2011-2952)

  - An out-of-bounds vulnerability exists in the ActiveX     browser plugin. (CVE-2011-2953)

  - A use-after-free vulnerability exists in Embedded     AutoUpdate. (CVE-2011-2954)

  - A use-after-free vulnerability exists in Embedded     Modal Dialog. (CVE-2011-2955)

ID	Name	Product	Family	Severity
6455	Real Networks RealPlayer < 14.0.6.666 (Build 12.0.1.666) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
55908	RealPlayer for Windows < Build 12.0.1.666 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-2955

critical

Tenable Plugins

high

high