製品・ソフトウェアに関する情報

JVN脆弱性詳細

Windows 上で稼働する RealNetworks RealPlayer における任意のコードを実行される脆弱性

Title	Windows 上で稼働する RealNetworks RealPlayer における任意のコードを実行される脆弱性
Summary	Windows 上で稼働する RealNetworks RealPlayer には、YUV420 変換中の容量を適切に処理しないため、任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された MP4 コンテンツを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 26, 2010, midnight
Registration Date	Sept. 17, 2010, 3:56 p.m.
Last Update	Sept. 17, 2010, 3:56 p.m.

Affected System

リアルネットワークス

RealNetworks RealPlayer 11.0 から 11.1

RealNetworks RealPlayer SP 1.0 から 1.1.4

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-0117	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0117
National Vulnerability Database (NVD)
2	CVE-2010-0117	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0117

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
Customer Support
1	Releases Update to Address Security Vulnerabilities	http://service.real.com/realplayer/security/08262010_player/en/
2	セキュリティ脆弱性に対応するアップデートをリリース	http://service.real.com/realplayer/security/08262010_player/ja/

その他

No	Name	URL
ISS X-Force Database
1	61421	http://xforce.iss.net/xforce/xfdb/61421
SecurityFocus
2	42775	http://www.securityfocus.com/bid/42775
VUPEN Security
3	VUPEN/ADV-2010-2216	http://www.vupen.com/english/advisories/2010/2216

Change Log

No	Changed Details	Date of change
0	[2010年09月17日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2010-0117

Summary	RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows do not properly handle dimensions during YUV420 transformations, which might allow remote attackers to execute arbitrary code via crafted MP4 content.
Publication Date	Aug. 31, 2010, 5 a.m.
Registration Date	Jan. 29, 2021, 10:56 a.m.
Last Update	Nov. 21, 2024, 10:11 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:realnetworks:realplayer:11.0:::::::*
cpe:2.3:a:realnetworks:realplayer:11.1:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows::::::::

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows::::::::

Related information, measures and tools

No	URL	タグ
1	http://secunia.com/advisories/41096
2	http://secunia.com/advisories/41096
3	http://secunia.com/advisories/41154
4	http://secunia.com/advisories/41154
5	http://secunia.com/secunia_research/2010-5/	Vendor Advisory
6	http://secunia.com/secunia_research/2010-5/	Vendor Advisory
7	http://service.real.com/realplayer/security/08262010_player/en/	Vendor Advisory
8	http://service.real.com/realplayer/security/08262010_player/en/	Vendor Advisory
9	http://www.securitytracker.com/id?1024370
10	http://www.securitytracker.com/id?1024370
11	http://www.vupen.com/english/advisories/2010/2216
12	http://www.vupen.com/english/advisories/2010/2216
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/61421
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/61421
15	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7169
16	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7169

Common Vulnerabilities List

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:::::::*
cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows::::::::