Secunia

A vulnerability has been discovered in RealPlayer, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a signedness error in MPAMedia.dll when handling playlist names. This can be exploited to cause a stack-based buffer overflow by e.g. importing a file into a specified playlist with an overly long name via the "Import()" method of the IERPCtl ActiveX control (ierpplug.dll).

Successful exploitation allows execution of arbitrary code.

NOTE: The vulnerability is currently being actively exploited.

Solution
Apply patch for RealPlayer 10.5 and 11 beta:
Further details available in Customer Area

Provided and/or discovered by
Reported as a 0-day.

Changelog
Further details available in Customer Area

Original Advisory
RealNetworks:
http://service.real.com/realplayer/security/191007_player/en/
http://docs.real.com/docs/security/SecurityUpdate101907Player.pdf

Other references
Further details available in Customer Area

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area