CVE-2010-3000

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 7.5%

from disclosure to weapon14 days

Published on NVDAug 30

1st PoC+14d

exploitation probability

7.5%top 6% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Multiple integer overflows in the ParseKnownType function in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows allow remote attackers to execute arbitrary code via crafted (1) HX_FLV_META_AMF_TYPE_MIXEDARRAY or (2) HX_FLV_META_AMF_TYPE_ARRAY data in an FLV file.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/14992

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/41096 http://secunia.com/advisories/41154 http://service.real.com/realplayer/security/08262010_player/en/https://exchange.xforce.ibmcloud.com/vulnerabilities/61423 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6651 http://www.securityfocus.com/archive/1/513383/100/0/threaded http://www.securitytracker.com/id?1024370 http://www.vupen.com/english/advisories/2010/2216 http://www.zerodayinitiative.com/advisories/ZDI-10-167