Bug 150072

Summary:	HelixPlayer Vuln (CAN-2005-0455)
Product:	Red Hat Enterprise Linux 4	Reporter:	Colin Walters <walters>
Component:	realplayer	Assignee:	Colin Walters <walters>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	CC:	barryn
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-02-21 19:08:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Colin Walters 2005-03-02 04:48:41 UTC

RealPlayer is also vulnerable; waiting on final 1.0.3 upstream release.

+++ This bug was initially created as a clone of Bug #150048 +++

Description of problem:
A couple buffer overflows.

http://www.idefense.com/application/poi/display?id=209&type=vulnerabilities
http://service.real.com/help/faq/security/050224_player/EN/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0455

Version-Release number of selected component (if applicable):
HelixPlayer-1.0.1.gold-6.i386.rpm

Additional info:
HelixPlayer 1.0.2, with fixes for these exploits, is available at:
https://player.helixcommunity.org/2004/downloads/

Comment 1 Barry K. Nathan 2005-03-06 07:30:07 UTC

Looks to me like there's a HelixPlayer erratum now:
https://rhn.redhat.com/errata/RHSA-2005-271.html

Should this bug be closed? (And shouldn't it be against HelixPlayer not
realplayer for that matter?)

Comment 2 Colin Walters 2005-03-06 16:12:37 UTC


*** This bug has been marked as a duplicate of 150050 ***

Comment 3 Red Hat Bugzilla 2006-02-21 19:08:14 UTC

Changed to 'CLOSED' state since 'RESOLVED' has been deprecated.