Unscored severity · published Jan 12, 2015
CVE-2013-2603
The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid…
–
CVSS
4.2%
EPSS
No
On KEV
Description
The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid parameter types, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted arguments to the (1) AddTag, (2) Ping, (3) QueuePause, (4) QueueRemove, (5) QueueTop, (6) RemoveTag, (7) TagRemoved, or (8) message method.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RI
Realarcade Installer · Realnetworks
2.6.0.481 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2603
www.osvdb.org
http://www.osvdb.org/96919
www.riskbasedsecurity.com
http://www.riskbasedsecurity.com/reports/RBS-GameHouseAnalysis-Sept2013.pdf
www.riskbasedsecurity.com
https://www.riskbasedsecurity.com/research/RBS-2013-006.pdf
More from Realarcade Installer
–
CVE-2013-2604
RealNetworks GameHouse RealArcade Installer (aka ActiveMARK Game Installer) 2.6.0.481 and 3.0.7 uses weak permissions (Create Files/Write Data) for the GameHouse Games directory…