The Channel logo


By | Dan Goodin 25th July 2008 22:30

High-priority patch fixes critical vulns in RealPlayer

Available in Windows, Mac and Linux

RealNetworks has issued an update that patches four security holes in its RealPlayer jukebox program, including a critical flaw that vulnerability tracker Secunia published today.

The company says versions for Windows, Mac, Linux operating systems are all vulnerable to at least one of the flaws and that users should update as soon as possible.

Among the bugs that are fixed is a flaw within the handling of frames in Shockwave Flash (SWF) files that can be triggered by a heap-based buffer overflow. Secunia published this advisory warning of the vulnerability, which carries the common vulnerability and exposure designation CVE-2007-5400.

A second bug, CVE-2007-1309, affects the RealAudioObjects.RealAudio ActiveX control, which doesn't properly manage memory for the Console property, allowing the remote execution of code. Details weren't yet available about the remaining two vulnerabilities, CVE-2008-3064 and CVE-2008-3066.

RealNetworks thanked Dyon Balding, Elazar Broad, CERT/CC, Haifei Li and Peter Vreugdenhil (working with TippingPoint) for bringing the vulnerabilities to its attention.

The advisory is here. ®

comment icon Read 14 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe