Unscored severity · published Oct 20, 2007
CVE-2007-5601
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne…
–
CVSS
42.2%
EPSS
No
On KEV
Description
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.
Exploitation
Is it being used?
Exploit prediction (EPSS)42.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Realplayer · Realnetworks
10.0; 10.5; 11_beta · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5601
Vendor Advisory
http://secunia.com/advisories/27248
service.real.com
http://service.real.com/realplayer/security/191007_player/en/
www.infosecblog.org
http://www.infosecblog.org/2007/10/nasa-bans-ie.html
US Government Resource
http://www.kb.cert.org/vuls/id/871673
www.securityfocus.com
http://www.securityfocus.com/bid/26130
www.securitytracker.com
http://www.securitytracker.com/id?1018843
More from Realplayer
9.8
CVE-2022-32270
In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution
9.8
CVE-2022-32269
In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core)
9.6
CVE-2022-32271
In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability
8.8
CVE-2022-32291
In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file
5.5
CVE-2017-9302
RealPlayer 16.0.2.32 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp4 file