- Issued:
- 2008-07-31
- Updated:
- 2008-09-17
RHSA-2008:0812 - Security Advisory
Synopsis
Critical: RealPlayer security update
Type/Severity
Security Advisory: Critical
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
Topic
RealPlayer 10.0.9 as shipped in Red Hat Enterprise Linux 3 Extras, 4
Extras, and 5 Supplementary, contains a security flaw and should not be
used.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
[Updated 17 September 2008]
We have updated this erratum to include packages which remove RealPlayer
from Red Hat Enterprise Linux 3 Extras, 4 Extras and 5 Supplementary.
Description
RealPlayer is a media player that provides media playback locally and via
streaming.
RealPlayer 10.0.9 is vulnerable to a critical security flaw and should no
longer be used. A remote attacker could leverage this flaw to execute
arbitrary code as the user running RealPlayer. (CVE-2007-5400)
This issue is addressed in RealPlayer 11. Red Hat is unable to ship
RealPlayer 11 due to additional proprietary codecs included in that
version. Therefore, users who wish to continue to use RealPlayer should get
an update directly from www.real.com.
This update removes the RealPlayer 10.0.9 packages due to their known
security vulnerabilities.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
Affected Products
- Red Hat Enterprise Linux Server 5 x86_64
- Red Hat Enterprise Linux Server 5 i386
- Red Hat Enterprise Linux Server 4 x86_64
- Red Hat Enterprise Linux Server 4 i386
- Red Hat Enterprise Linux Server 3 x86_64
- Red Hat Enterprise Linux Server 3 i386
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 x86_64
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 i386
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 4ES x86_64
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 4ES i386
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 4AS x86_64
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 4AS i386
- Red Hat Enterprise Linux Workstation 5 x86_64
- Red Hat Enterprise Linux Workstation 5 i386
- Red Hat Enterprise Linux Workstation 4 x86_64
- Red Hat Enterprise Linux Workstation 4 i386
- Red Hat Enterprise Linux Workstation 3 x86_64
- Red Hat Enterprise Linux Workstation 3 i386
- Red Hat Enterprise Linux Desktop 5 x86_64
- Red Hat Enterprise Linux Desktop 5 i386
- Red Hat Enterprise Linux Desktop 4 x86_64
- Red Hat Enterprise Linux Desktop 4 i386
- Red Hat Enterprise Linux Desktop 3 x86_64
- Red Hat Enterprise Linux Desktop 3 i386
- Red Hat Enterprise Linux Server from RHUI 5 x86_64
- Red Hat Enterprise Linux Server from RHUI 5 i386
Fixes
- BZ - 456855 - CVE-2007-5400 RealPlayer: SWF Frame Handling Buffer Overflow
CVEs
Red Hat Enterprise Linux Server 5
SRPM | |
---|---|
x86_64 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
i386 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
Red Hat Enterprise Linux Server 4
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux Server 3
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux for x86_64 - Extended Update Support 4ES
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux for x86_64 - Extended Update Support 4AS
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux Workstation 5
SRPM | |
---|---|
x86_64 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
i386 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
Red Hat Enterprise Linux Workstation 4
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux Workstation 3
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux Desktop 5
SRPM | |
---|---|
x86_64 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
i386 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
Red Hat Enterprise Linux Desktop 4
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux Desktop 3
SRPM | |
---|---|
x86_64 | |
i386 |
Red Hat Enterprise Linux Server from RHUI 5
SRPM | |
---|---|
x86_64 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
i386 | |
RealPlayer-uninstall-10.0.9-4.el5.i386.rpm | SHA-256: 98d3933dbf91abd8ec64403bc2e16a227572c369eac68f2cde4061e8ad13d276 |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.