Unscored severity · published Feb 21, 2011
CVE-2011-0694
RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which…
–
CVSS
6.6%
EPSS
No
On KEV
Description
RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.6% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Realplayer · Realnetworks
11.0; 11.1; 14.0.0; 14.0.1; 2.0; 2.1; +3 more · source: NVD
RS
Realplayer SP · Realnetworks
1.0.0; 1.0.1; 1.0.2; 1.0.5; 1.1; 1.1.1; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0694
Vendor Advisory
http://docs.real.com/docs/security/SecurityUpdate020811RPE.pdf
osvdb.org
http://osvdb.org/70849
Vendor Advisory
http://secunia.com/advisories/43268
securityreason.com
http://securityreason.com/securityalert/8098
Vendor Advisory
http://service.real.com/realplayer/security/02082011_player/en/
www.securityfocus.com
http://www.securityfocus.com/archive/1/516318/100/0/threaded
More from Realplayer
9.8
CVE-2022-32270
In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution
9.8
CVE-2022-32269
In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core)
9.6
CVE-2022-32271
In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability
8.8
CVE-2022-32291
In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file
5.5
CVE-2017-9302
RealPlayer 16.0.2.32 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp4 file