The installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows on the remote host is prone to buffer overflow and heap overflow vulnerabilities.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application.  Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass RealPlayer skin files (ie, files with the extension '.rjs') to the application.

現已提供更新版 RealPlayer 套件，可修正一個格式字串錯誤。

Red Hat 安全性回應團隊已將此更新評等為具有重大安全性影響。

RealPlayer 是一種媒體播放程式，可於本機及透過資料流播放媒體。

在 RealPlayer 處理 RealPix (.rp) 檔案的方式中發現一個格式字串錯誤。格式錯誤的 RealPix 檔案可能會以執行 RealPlayer 的使用者身分執行任意程式碼。Common Vulnerabilities and Exposures 專案 (cve.mitre.org) 已將名稱 CVE-2005-2710 指派給此問題。

建議所有 RealPlayer 使用者皆升級至此更新版套件，其中包含 RealPlayer 10.0.6 版，且不受此問題影響。

更新后的 RealPlayer 程序包修复了一个格式字符串缺陷，现在可用。

Red Hat 安全响应团队将此更新评级为具有严重安全影响。

RealPlayer 是一款提供本地媒体播放和流媒体播放的媒体播放器。

在 RealPlayer 处理 RealPix (.rp) 文件的方式中发现一个格式字符串缺陷。畸形 RealPix 文件可能以运行 RealPlayer 的用户的身份执行任意代码。通用漏洞和暴露计划 (cve.mitre.org) 已为此问题分配名称 CVE-2005-2710。

建议所有 RealPlayer 用户升级此更新后的程序包，其中包含 RealPlayer 版本 10.0.6，不易受到此问题的影响。

書式文字列のバグを修正する更新済みの RealPlayer パッケージが、現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新には重大なセキュリティインパクトがあるものとして評価しています。

RealPlayer は、ローカルやストリーミングによるメディアのプレイバックを可能にするメディアプレイヤーです。

RealPlayer が RealPix（.rp）ファイルを処理する方法で、書式文字列のバグが発見されました。無効な形式の RealPix ファイルが、RealPlayer を実行しているユーザーとして任意のコードを実行する可能性があります。Common Vulnerabilities and Exposures プロジェクト（cve.mitre.org）は、この問題に CVE-2005-2710 の識別名を割り当てています。

RealPlayer の全ユーザーは、こRealPlayer のバージョン 10.0.6 が含まれるこの更新済みパッケージへアップグレードし、この問題に対しての脆弱を解決することが推奨されます。

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:788 advisory.

    HelixPlayer is a media player.

    A format string bug was discovered in the way HelixPlayer processes RealPix     (.rp) files. It is possible for a malformed RealPix file to execute     arbitrary code as the user running HelixPlayer. The Common Vulnerabilities     and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2710     to this issue.

    All users of HelixPlayer are advised to upgrade to this updated package,     which contains HelixPlayer version 10.0.6 and is not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows on the remote host is affected by multiple buffer overflow vulnerabilities. 

An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application.  Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass to the application RealPlayer skin files (ie, files with the extension '.rjs').

An integer overflow has been discovered in helix-player, the helix audio and video player. This flaw could allow a remote attacker to run arbitrary code on a victims computer by supplying a specially crafted network resource.

An updated HelixPlayer package that fixes a string format issue is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

A format string bug was discovered in the way HelixPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running HelixPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2710 to this issue.

All users of HelixPlayer are advised to upgrade to this updated package, which contains HelixPlayer version 10.0.6 and is not vulnerable to this issue.

An updated RealPlayer package that fixes a format string bug is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player that provides media playback locally and via streaming.

A format string bug was discovered in the way RealPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running RealPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2710 to this issue.

All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.6 and is not vulnerable to this issue.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
3286	RealPlayer for Windows Multiple Overflows (2)	Nessus Network Monitor	Web Clients	2005/11/11	2019/3/6	medium
63829	RHEL 3 / 4 : RealPlayer (RHSA-2005:762)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
63829	RHEL 3 / 4：RealPlayer (RHSA-2005:762)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
63829	RHEL 3 / 4：RealPlayer（RHSA-2005:762）	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high
19836	RHEL 4 : HelixPlayer (RHSA-2005:788)	Nessus	Red Hat Local Security Checks	2005/10/5	2024/11/4	critical
20184	RealPlayer for Windows Multiple Overflows	Nessus	Windows	2005/11/11	2018/11/15	high
22781	Debian DSA-915-1 : helix-player - buffer overflow	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
23983	CentOS 4 : Helix / Player (CESA-2005:788)	Nessus	CentOS Local Security Checks	2007/1/8	2021/1/4	high
63829	RHEL 3 / 4 : RealPlayer (RHSA-2005:762)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high

检测

插件搜索

medium

high

high

high

critical

high

medium

high

high