Three vulnerabilities have been discovered in RealPlayer, which can be exploited by malicious people to compromise a user's system.

1) A boundary error within "embd3260.dll" when constructing error messages can be exploited to cause a heap-based buffer overflow via a specially crafted movie file embedded in an HTML document.

2) A boundary error when parsing URLs can be exploited to cause a buffer overflow via a RAM file containing a specially crafted URL with a large number of period characters (".").

3) A boundary error within the handling of certain media files (".RA", ."RM", ."RV", and ".RMJ") can be exploited to cause a heap-based buffer overflow via a specially crafted media file containing malformed parameters.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

Solution
The vendor has issued a patch, which is available via the "Check for Update" feature.

Provided and/or discovered by
1) Karl Lynn, eEye Digital Security.
2) Greg MacManus, iDEFENSE.
3) John Heasman, NGSSoftware.

Changelog
Further details available in Customer Area

Original Advisory
RealNetworks:
http://www.service.real.com/help/faq/security/040610_player/

eEye Digital Security:
http://www.eeye.com/html/research/advisories/AD20040610.html

iDEFENSE:
http://www.idefense.com/application/poi/display?id=109&type=vulnerabilities

NGSSoftware:
http://www.nextgenss.com/advisories/realra.txt

Deep Links
Links available in Customer Area