CVE-2011-0694

RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
VendorProductVersion
realnetworksrealplayer
11.0
realnetworksrealplayer
11.1
realnetworksrealplayer
14.0.0
realnetworksrealplayer
14.0.1
realnetworksrealplayer_sp
1.0.0
realnetworksrealplayer_sp
1.0.1
realnetworksrealplayer_sp
1.0.2
realnetworksrealplayer_sp
1.0.5
realnetworksrealplayer_sp
1.1
realnetworksrealplayer_sp
1.1.1
realnetworksrealplayer_sp
1.1.2
realnetworksrealplayer_sp
1.1.3
realnetworksrealplayer_sp
1.1.4
realnetworksrealplayer_sp
1.1.5
realnetworksrealplayer
2.0
realnetworksrealplayer
2.1
realnetworksrealplayer
2.1.2
realnetworksrealplayer
2.1.3
realnetworksrealplayer
2.1.4
𝑥
= Vulnerable software versions
References
http://docs.real.com/docs/security/SecurityUpdate020811RPE.pdf
http://osvdb.org/70849
http://secunia.com/advisories/43268
http://securityreason.com/securityalert/8098
http://service.real.com/realplayer/security/02082011_player/en/
http://www.securityfocus.com/archive/1/516318/100/0/threaded
http://www.securitytracker.com/id?1025058
http://www.zerodayinitiative.com/advisories/ZDI-11-076
http://docs.real.com/docs/security/SecurityUpdate020811RPE.pdf
http://osvdb.org/70849
http://secunia.com/advisories/43268
http://securityreason.com/securityalert/8098
http://service.real.com/realplayer/security/02082011_player/en/
http://www.securityfocus.com/archive/1/516318/100/0/threaded
http://www.securitytracker.com/id?1025058
http://www.zerodayinitiative.com/advisories/ZDI-11-076