CVE-2010-4388

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-12-14 · updated 2026-06-16
Weakness: CWE-20

Description

The (1) Upsell.htm, (2) Main.html, and (3) Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended Local Machine Zone restrictions and load arbitrary ActiveX controls, via unspecified vectors.

Affected products

RealNetworks Realplayer: 11.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5 (+3)
RealNetworks Realplayer Sp: 1.0.0, 1.0.1, 1.0.2, 1.0.5, 1.1, 1.1.1 (+4)

References

http://osvdb.org/69857
http://osvdb.org/69858
http://osvdb.org/69859
http://service.real.com/realplayer/security/12102010_player/en/
http://www.securitytracker.com/id?1024861
http://www.zerodayinitiative.com/advisories/ZDI-10-276
http://www.zerodayinitiative.com/advisories/ZDI-10-277
http://www.zerodayinitiative.com/advisories/ZDI-10-278
http://osvdb.org/69857
http://osvdb.org/69858
http://osvdb.org/69859
http://service.real.com/realplayer/security/12102010_player/en/

Get alerted when CVE-2010-4388 or the next vulnerability affects your stack