[webcast-l] RealPlayer vulnerabilities

[Bill Best]

http://www.service.real.com/help/faq/security/040123_player/EN/

Description:
Multiple vulnerabilities have been discovered in RealOne Player and 
RealPlayer, where the most serious potentially can be exploited by 
malicious people to compromise a vulnerable system.

Boundary errors when parsing ".RP", ".RT", ".RAM", ".RPM", and ".SMIL" 
files can be exploited to cause buffer overflows via specially crafted 
files (e.g. hosted on a malicious web site). Successful exploitation 
allows execution of arbitrary code on a user's system.

An unspecified error in the handling of ".RMP" files can be exploited to 
download and execute arbitrary code on a user's system.

An input validation error in the handling of ".SMIL" and other files can 
be exploited to conduct cross-site scripting attacks.

The following products are affected:
* RealPlayer 8
* RealPlayer 10 Beta
* RealOne Player
* RealOne Player v2
* RealOne Enterprise Desktop / RealPlayer Enterprise (all language 
versions, all platforms)