« Volver al listado

CVE-2010-0417

Estado: ModificadaMedia (5)—

Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a RuleBook structure with a large number of rule-separator characters that trigger heap memory corruption.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Realnetworks — Helix PlayerRealnetworks — Realplayer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0417",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-02-18T23:30:00.583",
  "references": [
    {
      "url": "http://lists.helixcommunity.org/pipermail/common-cvs/2008-January/015484.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/38450",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0094.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=561860",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://helixcommunity.org/viewcvs/common/util/rlstate.cpp?view=log#rev1.10",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11364",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.helixcommunity.org/pipermail/common-cvs/2008-January/015484.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/38450",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0094.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=561860",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://helixcommunity.org/viewcvs/common/util/rlstate.cpp?view=log#rev1.10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11364",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a RuleBook structure with a large number of rule-separator characters that trigger heap memory corruption."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer en common/util/rlstate.cpp en Helix Player v1.0.6 y  RealPlayer, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente la ejecución de código de su elección a través de una estructura RuleBook con un elevado número de caracteres de rule-separator (Separador de reglas) que provocan una corrupción de memoria dinámica (heap)."
    }
  ],
  "lastModified": "2026-06-16T23:16:07.600",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:realnetworks:helix_player:1.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D391052A-4982-4E68-A6F9-603580E2DB9F"
            },
            {
              "criteria": "cpe:2.3:a:realnetworks:realplayer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCA29F41-A723-435D-AA35-EE03280B58C8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}