{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated RealPlayer package that fixes a buffer overflow issue is now\navailable.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.\n\n[Updated 05 Jul 2005]\nThe previous package for Red Hat Enterprise Linux 4 did not contain the\nproper fix for this issue.  This erratum has been updated with a replacement\npackage that corrects this issue",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "RealPlayer is a media player that provides media playback locally and\nvia streaming. It plays RealAudio, RealVideo, MP3, 3GPP Video, Flash, SMIL\n2.0, JPEG, GIF, PNG, RealPix, RealText, and more.\n\nA buffer overflow bug was found in the way RealPlayer processes SMIL files.\nAn attacker could create a specially crafted SMIL file that could combine\nwith a malicious Web server to execute arbitrary code when the file was\nopened by a user. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-1766 to this issue.\n\nAll users of RealPlayer are advised to upgrade to this updated package,\nwhich contains RealPlayer version 10.0.5 and is not vulnerable to this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2005:523",
        "url": "https://access.redhat.com/errata/RHSA-2005:523"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "159864",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=159864"
      },
      {
        "category": "external",
        "summary": "159868",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=159868"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_523.json"
      }
    ],
    "title": "Red Hat Security Advisory: RealPlayer security update",
    "tracking": {
      "current_release_date": "2024-11-14T10:03:53+00:00",
      "generator": {
        "date": "2024-11-14T10:03:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2005:523",
      "initial_release_date": "2005-06-23T19:21:00+00:00",
      "revision_history": [
        {
          "date": "2005-06-23T19:21:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2005-06-23T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T10:03:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 3 Extras",
                "product": {
                  "name": "Red Hat Desktop version 3 Extras",
                  "product_id": "Red Hat Desktop version 3 Extras",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 4 Extras",
                "product": {
                  "name": "Red Hat Desktop version 4 Extras",
                  "product_id": "Red Hat Desktop version 4 Extras",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Supplementary"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2005-1766",
      "discovery_date": "2005-06-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1617668"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Heap-based buffer overflow in rtffplin.cpp in RealPlayer 10.5 6.0.12.1056 on Windows, and 10, 10.0.1.436, and other versions before 10.0.5 on Linux, allows remote attackers to execute arbitrary code via a RealMedia file with a long RealText string, such as an SMIL file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Desktop version 3 Extras",
          "Red Hat Desktop version 4 Extras"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-1766"
        },
        {
          "category": "external",
          "summary": "RHBZ#1617668",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617668"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-1766",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-1766"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-1766",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-1766"
        }
      ],
      "release_date": "2005-06-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2005-06-23T19:21:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Desktop version 3 Extras",
            "Red Hat Desktop version 4 Extras"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2005:523"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "security flaw"
    }
  ]
}