CVE-2011-0694
Summary
| CVE | CVE-2011-0694 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-02-21 18:00:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function. |
Risk And Classification
Primary CVSS: v2.0 9.3 from [email protected]
AV:N/AC:M/Au:N/C:C/I:C/A:C
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:M/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Realnetworks | Realplayer | 11.0 | All | All | All |
| Application | Realnetworks | Realplayer | 11.1 | All | All | All |
| Application | Realnetworks | Realplayer | 14.0.0 | All | All | All |
| Application | Realnetworks | Realplayer | 14.0.1 | All | All | All |
| Application | Realnetworks | Realplayer | 2.0 | All | enterprise | All |
| Application | Realnetworks | Realplayer | 2.1 | All | enterprise | All |
| Application | Realnetworks | Realplayer | 2.1.2 | All | enterprise | All |
| Application | Realnetworks | Realplayer | 2.1.3 | All | enterprise | All |
| Application | Realnetworks | Realplayer | 2.1.4 | All | enterprise | All |
| Application | Realnetworks | Realplayer Sp | 1.0.0 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.0.1 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.0.2 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.0.5 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.1 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.1.1 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.1.2 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.1.3 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.1.4 | All | All | All |
| Application | Realnetworks | Realplayer Sp | 1.1.5 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Zero Day Initiative | af854a3a-2127-422b-91ae-364da2661108 | www.zerodayinitiative.com | |
| Feb. 2011 Update | af854a3a-2127-422b-91ae-364da2661108 | service.real.com | Vendor Advisory |
| RealPlayer Predictable Temporary Filename Lets Remote Users Execute Arbitrary Code - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| RealPlayer Predictable Temporary Filename Code Execution Vulnerability - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| docs.real.com/docs/security/SecurityUpdate020811RPE.pdf | af854a3a-2127-422b-91ae-364da2661108 | docs.real.com | Vendor Advisory |
| osvdb.org/70849 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| RealNetworks Real Player Predictable Temporary File Remote Code Execution Vulnerability - CXSecurity.com | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.