Two vulnerabilities have been discovered in Helix Player, which potentially can be exploited by malicious people to compromise a user's system.

1) A format string error exists when displaying the invalid-handle error message. This may be exploited to execute arbitrary code via a specially crafted ".rp" (RealPix) file that contains format-string specifiers in the "handle" attribute of the "image" tag. The ".rt" file format may also be affected.

2) A format string error exists when displaying the "missing XML tag end" error message. This may be exploited to execute arbitrary code via a specially crafted ".rp" file that contains format-string specifiers in the attributes of the "head" tag.

Successful exploitation requires that the user is e.g. tricking into opening or following a link to a malicious ".rp" file.

The vulnerabilities have been confirmed in Helix Player 1.0.5.757 (gold), and affects only the Linux/Unix platforms. Prior versions may also be affected.

Note: Exploit code for vulnerability #1 is publicly available.

Solution
Update to version 1.0.6.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) c0ntex
2) iDEFENSE

Changelog
Further details available to Secunia VIM customers

Original Advisory
RealNetworks:
http://service.real.com/help/faq/security/050930_player/EN/

c0ntex:
http://open-security.org/advisories/13

iDEFENSE:
http://www.idefense.com/application/poi/display?id=311&type=vulnerabilities&flashstatus=true

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers