CVE-2009-4257: realnetworks helix_player

Modified

Published 25-01-2010Last modified 07-08-2024

Vulnerability summary

CVE-2009-4257 is a high (CVSS 9.3) vulnerability in realnetworks helix_player. EPSS estimates a 8.49% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 9.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

8.49%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2010:0094

Timeline

25-01-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

8.49%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 8.49% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Realnetworks3 products

helix_player10.0 | 11.0.0 | 11.0.1
realplayer10.0 | 10.5 | 11.0 | 11.0.1 | 11.0.2 | 11.0.3 | 11.0.4 | 11.0.5 | 10.1 | 11.0.0
realplayer_sp1.0.0 | 1.0.1

1 vendor · 3 products

References

14 links

www.redhat.com/support/errata/RHSA-2010-0094.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/archive/1/509105/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2010/0178VDB EntryX Refsource VUPENPatchVendor Advisory
lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008678.htmlMailing ListX Refsource MLIST
exchange.xforce.ibmcloud.com/vulnerabilities/55798VDB EntryX Refsource XF
securitytracker.com/id?1023489VDB EntryX Refsource SECTRACKPatch
service.real.com/realplayer/security/01192010_player/en/X Refsource CONFIRMPatchVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=561309X Refsource CONFIRM
secunia.com/advisories/38450Third Party AdvisoryX Refsource SECUNIAVendor Advisory
helixcommunity.org/viewcvs/datatype/smil/common/smlpkt.cpp?view=logX Refsource CONFIRM

Show all 14 references

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11110VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/38218Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.zerodayinitiative.com/advisories/ZDI-10-007/X Refsource MISCPatch
www.securityfocus.com/bid/37880VDB EntryX Refsource BID