NVD

Id
1268  
Name
CVE-2008-1309  
Description
The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-03-12  
Modified Date
2016-11-18  
Seq
2008-1309  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
8005 1268 CVE-2008-1309 20080310 Real Networks RealPlayer ActiveX Control Heap Corruption  View
8006 1268 CVE-2008-1309 http://service.real.com/realplayer/security/07252008_player/en/  View
8007 1268 CVE-2008-1309 VU#831457  View
8008 1268 CVE-2008-1309 5332  View
8009 1268 CVE-2008-1309 20080725 ZDI-08-047: RealNetworks RealPlayer rmoc3260 ActiveX Control Memory Corruption Vulnerability  View
8010 1268 CVE-2008-1309 28157  View
8011 1268 CVE-2008-1309 1019576  View
8012 1268 CVE-2008-1309 1020563  View
8013 1268 CVE-2008-1309 ADV-2008-0842  View
8014 1268 CVE-2008-1309 ADV-2008-2194  View
8015 1268 CVE-2008-1309 http://www.zerodayinitiative.com/advisories/ZDI-08-047/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46276 JVNDB-2008-001586 RealNetworks RealPlayer の ActiveX コントロールにおけるメモリ管理不備の脆弱性 RealNetworks RealPlayer の rmoc3260.dll には RealAudioObjects.RealAudio ActiveX コントロールにおいて、コンソールプロパティのメモリの管理に不備があり、開放したヒープメモリ領域を上書き可能となり、任意のコードを実行される、またはサービス運用妨害 (DoS) 状態にされる脆弱性が存在します。 CVE-2008-1309 31422 CVE-2008-1309 1268 9.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001586.html 2008-03-12 2008-09-02 View