Multiple vulnerabilities have been reported in RealPlayer, where one has an unknown impact and others can be exploited by malicious people to access files or compromise a user's system.

For more information:
SA41096

1) An array-indexing error in the parsing of IVR data headers can be exploited to dereference memory outside the bounds of an array as an object pointer.

2) An error in a RealPlayer ActiveX control allows unauthorised file access.

The vulnerabilities are reported in version 11.1 and prior.

Solution
Upgrade to RealPlayer SP 1.1.5.

Provided and/or discovered by
1) An anonymous person via ZDI.
2) The vendor credits Behrang Fouladi, SensePost.

Changelog
Further details available in Customer Area

Original Advisory
RealNetworks:
http://service.real.com/realplayer/security/08262010_player/en/
http://service.real.com/realplayer/security/10152010_player/en/

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-166/

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area