CVE-2010-4235

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-04-04 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server 12.x, 13.x, and 14.x before 14.2, allows remote attackers to execute arbitrary code via vectors related to the x-wap-profile HTTP header.

Affected products

RealNetworks Helix Mobile Server: 12.0, 13.1.1, 14.0.0, 14.0.1
RealNetworks Helix Server: 12.0.0, 12.0.1, 13.0.0, 13.1.1, 14.0.0, 14.0.1

References

http://docs.real.com/docs/security/SecurityUpdate033111HS.pdf
http://www.securityfocus.com/bid/47110
http://docs.real.com/docs/security/SecurityUpdate033111HS.pdf
http://www.securityfocus.com/bid/47110

Get alerted when CVE-2010-4235 or the next vulnerability affects your stack