CVE-2007-3410

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 36.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-06-26 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and possibly 10.5, RealOne Player, RealPlayer Enterprise, and Helix Player 10.5-GOLD and 10.0.5 through 10.0.8, allows remote attackers to execute arbitrary code via an SMIL (SMIL2) file with a long wallclock value.

Affected products

RealNetworks Helix Player: 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.5-gold
RealNetworks Realone Player: all versions
RealNetworks Realplayer: 10.0, 10.1, 10.5
RealNetworks Realplayer Enterprise: all versions

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=547
http://osvdb.org/37374
http://osvdb.org/38342
http://secunia.com/advisories/25819
http://secunia.com/advisories/25859
http://secunia.com/advisories/26463
http://secunia.com/advisories/26828
http://secunia.com/advisories/27361
http://security.gentoo.org/glsa/glsa-200709-05.xml
http://securitytracker.com/id?1018297
http://securitytracker.com/id?1018299
http://service.real.com/realplayer/security/10252007_player/en/

Get alerted when CVE-2007-3410 or the next vulnerability affects your stack