CVE-2010-0416

2010-02-1823:30:00

CWE-119

redhat

web.nvd.nist.gov

cve-2010-0416

buffer overflow

remote attack

denial of service

code execution

helix player

realplayer

security vulnerability

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.1

Confidence

High

EPSS

0.244

Percentile

96.6%

JSON

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a URL argument containing a % (percent) character that is not followed by two hex digits.

Affected configurations

Nvd

Node

realnetworkshelix_playerMatch1.0.6linux

realnetworksrealplayerlinux

VendorProductVersionCPE
realnetworkshelix_player1.0.6cpe:2.3:a:realnetworks:helix_player:1.0.6:*:linux:*:*:*:*:*
realnetworksrealplayer*cpe:2.3:a:realnetworks:realplayer:*:*:linux:*:*:*:*:*

Vendor	Product	Version	CPE
realnetworks	helix_player	1.0.6	cpe:2.3:a:realnetworks:helix_player:1.0.6::linux:::::
realnetworks	realplayer	*	cpe:2.3:a:realnetworks:realplayer:::linux:::::*