CVE-2011-1426
18.04.2011, 18:55
The OpenURLInDefaultBrowser method in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2, and RealPlayer SP 1.0 through 1.1.5, launches a default handler for the filename specified in the first argument, which allows remote attackers to execute arbitrary code via a .rnx filename corresponding to a crafted RNX file.Enginsight
| Vendor | Product | Version |
|---|---|---|
| realnetworks | realplayer | 11.0 |
| realnetworks | realplayer | 11.1 |
| realnetworks | realplayer | 14.0.0 |
| realnetworks | realplayer | 14.0.1 |
| realnetworks | realplayer | 14.0.2 |
| realnetworks | realplayer_sp | 1.0.0 |
| realnetworks | realplayer_sp | 1.0.1 |
| realnetworks | realplayer_sp | 1.0.2 |
| realnetworks | realplayer_sp | 1.0.5 |
| realnetworks | realplayer_sp | 1.1 |
| realnetworks | realplayer_sp | 1.1.1 |
| realnetworks | realplayer_sp | 1.1.2 |
| realnetworks | realplayer_sp | 1.1.3 |
| realnetworks | realplayer_sp | 1.1.4 |
| realnetworks | realplayer_sp | 1.1.5 |
𝑥
= Vulnerable software versions
References