Vulnerability Details : CVE-2012-2406
RealNetworks RealPlayer before 15.0.4.53, and RealPlayer SP 1.0 through 1.1.5, does not properly parse ASMRuleBook data in RealMedia files, which allows remote attackers to execute arbitrary code via a crafted file.
Vulnerability category: Execute code
Products affected by CVE-2012-2406
- cpe:2.3:a:realnetworks:realplayer:*:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11_build_6.0.14.748:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:14.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:14.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:14.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:14.0.1.609:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:12.0.0.1548:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:8:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.0.2.2315:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:11.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:7:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:6:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:5:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:4:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:15.0.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:15.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer:15.02.71:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-2406
2.81%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 90 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-2406
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
References for CVE-2012-2406
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/75647
RealPlayer RealMedia ASMRuleBook code execution CVE-2012-2406 Vulnerability Report
-
http://service.real.com/realplayer/security/05152012_player/en/
RealPlayer and RealTimes Official Homepage – Real.comVendor Advisory
-
http://www.securitytracker.com/id?1027076
RealPlayer Bugs Let Remote Users Execute Arbitrary Code - SecurityTracker
Jump to