Strix
26.1K

CVE-2013-7260

UnknownEPSS 66.88%

Last modified

CVE-2013-7260 is a vulnerability of currently unknown severity. Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877.. EPSS estimates a 66.88% chance of exploitation in the next 30 days.

Description

Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877.

Metrics

EPSS Probability
66.88%

99.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
RealnetworksRealplayer<= 17.0.4.60—
RealnetworksRealplayer2.1.2—
RealnetworksRealplayer2.1.3—
RealnetworksRealplayer2.1.4—
RealnetworksRealplayer4—
RealnetworksRealplayer5—
RealnetworksRealplayer6—
RealnetworksRealplayer7—
RealnetworksRealplayer8—
RealnetworksRealplayer10.0—
RealnetworksRealplayer10.5—
RealnetworksRealplayer11.0—
RealnetworksRealplayer11.0.1—
RealnetworksRealplayer11.0.2—
RealnetworksRealplayer11.0.2.1744—
RealnetworksRealplayer11.0.2.2315—
RealnetworksRealplayer11.0.3—
RealnetworksRealplayer11.0.4—
RealnetworksRealplayer11.0.5—
RealnetworksRealplayer11.1—
RealnetworksRealplayer11.1.3—
RealnetworksRealplayer11_build_6.0.14.748—
RealnetworksRealplayer12.0.0.1444—
RealnetworksRealplayer12.0.0.1548—
RealnetworksRealplayer14.0.0—
RealnetworksRealplayer14.0.1—
RealnetworksRealplayer14.0.1.609—
RealnetworksRealplayer14.0.2—
RealnetworksRealplayer14.0.3—
RealnetworksRealplayer14.0.4—
RealnetworksRealplayer14.0.5—
RealnetworksRealplayer15.0.0—
RealnetworksRealplayer15.0.4—
RealnetworksRealplayer15.0.4.43—
RealnetworksRealplayer15.0.5.109—
RealnetworksRealplayer15.0.6.14—
RealnetworksRealplayer15.02.71—
RealnetworksRealplayer16.0.0—
RealnetworksRealplayer16.0.0.282—
RealnetworksRealplayer16.0.1.18—
RealnetworksRealplayer16.0.2.32—
RealnetworksRealplayer16.0.3.51—
RealnetworksRealplayer10.110.0.0. 481
RealnetworksRealplayer12.0.0.1701—
RealnetworksRealplayer12.0.1.1737—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2013-7260?
Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file, a different issue than CVE-2013-6877.
How severe is CVE-2013-7260?
Severity scoring for CVE-2013-7260 is pending analysis. The EPSS model estimates a 66.88% probability of exploitation in the next 30 days.
How do I fix CVE-2013-7260?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2013-7260?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST