CVE-2011-0694

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-02-21 · updated 2026-06-16

Description

RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.

Affected products

RealNetworks Realplayer: 11.0, 11.1, 14.0.0, 14.0.1, 2.0, 2.1 (+3)
RealNetworks Realplayer Sp: 1.0.0, 1.0.1, 1.0.2, 1.0.5, 1.1, 1.1.1 (+4)

References

http://docs.real.com/docs/security/SecurityUpdate020811RPE.pdf
http://osvdb.org/70849
http://secunia.com/advisories/43268
http://securityreason.com/securityalert/8098
http://service.real.com/realplayer/security/02082011_player/en/
http://www.securityfocus.com/archive/1/516318/100/0/threaded
http://www.securitytracker.com/id?1025058
http://www.zerodayinitiative.com/advisories/ZDI-11-076
http://docs.real.com/docs/security/SecurityUpdate020811RPE.pdf
http://osvdb.org/70849
http://secunia.com/advisories/43268
http://securityreason.com/securityalert/8098

Get alerted when CVE-2011-0694 or the next vulnerability affects your stack