Secunia

Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.

1) An input validation error within the processing of Internet Video Recording (IVR) files can be exploited to cause a memory corruption when a specially crafted IVR file is viewed.

2) An unspecified error within the processing of IVR files can be exploited to write a NULL-byte to an arbitrary memory address via an overly long file name length value within a specially crafted IVR file.

Successful exploitation potentially allows execution of arbitrary code e.g. when a user visits a malicious web page.

Solution
Update to the newest RealPlayer version.
Further details available in Customer Area

Provided and/or discovered by
1) Haifei Li, Fortinet's FortiGuard Global Security Research Team
2) Independently reported by Haifei Li of Fortinet's FortiGuard Global Security Research Team and by John Rambo via TippingPoint's Zero Day Initiative

Changelog
Further details available in Customer Area

Original Advisory
RealNetworks:
http://service.real.com/realplayer/security/01192010_player/en/

Fortinet's FortiGuard Global Security Research Team:
http://www.fortiguardcenter.com/advisory/FGA-2009-04.html

ZDI:
2) http://www.zerodayinitiative.com/advisories/ZDI-10-009/

Deep Links
Links available in Customer Area