CVE-2007-2263

CVE	CVE-2007-2263
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2007-10-31 17:46:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	Heap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and possibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote attackers to execute arbitrary code via an SWF (Flash) file with malformed record headers.

Primary CVSS: v2.0 9.3 from [email protected]

AV:N/AC:M/Au:N/C:C/I:C/A:C

Problem Types: CWE-119 | n/a

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Application	Realnetworks	Realone Player	All	All	mac	en
Application	Realnetworks	Realone Player	2.0	All	windows	All
Application	Realnetworks	Realplayer	10.0	All	windows	All
Application	Realnetworks	Realplayer	10.0	10.0.0.305	mac	All
Application	Realnetworks	Realplayer	10.0	10.0.0.331	mac	All
Application	Realnetworks	Realplayer	10.0	10.0.0.352	mac	All
Application	Realnetworks	Realplayer	10.0	10.0.5	linux	All
Application	Realnetworks	Realplayer	10.0	10.0.6	linux	All
Application	Realnetworks	Realplayer	10.0	10.0.7	linux	All
Application	Realnetworks	Realplayer	10.0	10.0.8	linux	All
Application	Realnetworks	Realplayer	10.0	10.0.9	linux	All
Application	Realnetworks	Realplayer	10.1	10.0.0.396	mac	All
Application	Realnetworks	Realplayer	10.1	10.0.0.412	mac	All
Application	Realnetworks	Realplayer	10.5	6.0.12.1040	windows	All
Application	Realnetworks	Realplayer	10.5	6.0.12.1578	windows	All
Application	Realnetworks	Realplayer	10.5	6.0.12.1698	windows	All
Application	Realnetworks	Realplayer	10.5	6.0.12.1741	windows	All
Application	Realnetworks	Realplayer Enterprise	All	All	windows	en

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
RealNetworks RealPlayer File Parsing Routines Multiple Vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Patch
osvdb.org/38344	af854a3a-2127-422b-91ae-364da2661108	osvdb.org
RealPlayer/RealOne/HelixPlayer Multiple Buffer Overflows - Advisories - Secunia	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Patch, Vendor Advisory
[VIM] RealPlayer Updates of October 25, 2007	af854a3a-2127-422b-91ae-364da2661108	www.attrition.org
RealNetworks RealPlayer SWF File Processing Remote Code Execution Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
Repository / Oval Repository	af854a3a-2127-422b-91ae-364da2661108	oval.cisecurity.org
SecurityTracker.com Archives - RealPlayer Buffer Overflows in Processing MP3, RM, SWF, RAM, and PLS Files Lets Remote Users Execute Arbitrary Code	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com
Webmail - OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com	Vendor Advisory
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com
RealPlayer and StarSearch by Real Official Homepage — Real.com	af854a3a-2127-422b-91ae-364da2661108	service.real.com	Patch
Zero Day Initiative	af854a3a-2127-422b-91ae-364da2661108	www.zerodayinitiative.com
SecurityFocus	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Organization	Published	Contributor	Statement
Red Hat	2007-11-01	Mark J Cox	This issue was fixed in RealPlayer for Red Hat Enterprise Linux 3 Extras, 4 Extras, 5 Supplementary by RHSA-2007:0841 on 17th August 2007: http://rhn.redhat.com/errata/RHSA-2007-0841.html)on (Our original advisory did not mention this issue was fixed as the details of the issue were not made public by RealNetworks until 25th October 2007)

There are currently no legacy QID mappings associated with this CVE.