CVE-2007-5601
72Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 42%
from disclosure to weapon0 days
Published on NVDOct 20
1st PoCOct 18
metasploitOct 18
VulnCheck+924d
exploitation probability
42%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.
Affected products
n/a · n/apublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/16497unverifiedexploitdbwww.exploit-db.com/exploits/30692unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://secunia.com/advisories/27248http://service.real.com/realplayer/security/191007_player/en/https://exchange.xforce.ibmcloud.com/vulnerabilities/37280http://www.infosecblog.org/2007/10/nasa-bans-ie.htmlhttp://www.kb.cert.org/vuls/id/871673http://www.securityfocus.com/bid/26130http://www.securitytracker.com/id?1018843http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.htmlhttp://www.us-cert.gov/cas/techalerts/TA07-297A.htmlhttp://www.vupen.com/english/advisories/2007/3548