CVE-2010-4376 describes a critical heap-based buffer overflow vulnerability in RealNetworks RealPlayer versions 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744. This flaw allows remote attackers to execute arbitrary code by supplying a large Screen Width value within the Screen Descriptor header of a GIF87a file delivered via an RTSP stream. With a CVSS score of 9.3, this vulnerability is highly severe, requiring no authentication and having a medium attack complexity, but leading to complete compromise of confidentiality, integrity, and availability. While no active exploitation, Metasploit, Nuclei, or ExploitDB entries are noted, and community discussion and media coverage are minimal, its high FAUCET Risk Score of 82/100 indicates significant potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
11.0CPE matchmatch criteria | cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:* | ||
11.0.1CPE matchmatch criteria | cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:* | ||
11.0.2CPE matchmatch criteria | cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:* | ||
11.0.3CPE matchmatch criteria | cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:* | ||
11.0.4CPE matchmatch criteria | cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.