CVE-2009-4242: realnetworks helix_player

Modified

Published 25-01-2010Last modified 07-08-2024

Vulnerability summary

CVE-2009-4242 is a high (CVSS 9.3) vulnerability in realnetworks helix_player. EPSS estimates a 8.45% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 9.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

8.45%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2010:0094

Timeline

25-01-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

8.45%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 8.45% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Realnetworks3 products

helix_player10.0 | 11.0.0 | 11.0.1
realplayer10.0 | 10.5 | 11.0 | 11.0.1 | 11.0.2 | 11.0.3 | 11.0.4 | 11.0.5 | 10.1 | 11.0.0
realplayer_sp1.0.0 | 1.0.1

1 vendor · 3 products

References

15 links

www.redhat.com/support/errata/RHSA-2010-0094.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2010/0178VDB EntryX Refsource VUPENPatchVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10144VDB EntrySignatureX Refsource OVAL
exchange.xforce.ibmcloud.com/vulnerabilities/55795VDB EntryX Refsource XF
securitytracker.com/id?1023489VDB EntryX Refsource SECTRACKPatch
bugzilla.redhat.com/show_bug.cgi?id=561436X Refsource CONFIRM
lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008633.htmlMailing ListX Refsource MLIST
service.real.com/realplayer/security/01192010_player/en/X Refsource CONFIRMPatchVendor Advisory
secunia.com/advisories/38450Third Party AdvisoryX Refsource SECUNIA
www.zerodayinitiative.com/advisories/ZDI-10-006/X Refsource MISCPatch

Show all 15 references

osvdb.org/61966VDB EntryX Refsource OSVDB
secunia.com/advisories/38218Third Party AdvisoryX Refsource SECUNIAVendor Advisory
helixcommunity.org/viewcvs/datatype/image/gif/common/gifcodec.cpp?view=logX Refsource CONFIRM
www.securityfocus.com/archive/1/509096/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/bid/37880VDB EntryX Refsource BID