CVE-2005-2922
Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions...
CVE-2005-2922 is a high vulnerability (CVSS 9.3) in Realnetworks Helix Player, published December 31, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.78%, the 93rd percentile. No source names a fixed version.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 5.78%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
HelixPlayerRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
HelixPlayer-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
HelixPlayerRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
HelixPlayer-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
HelixPlayerRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
HelixPlayer-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
HelixPlayerRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
HelixPlayer-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 3 CVEs | before 1:1.0.6-0.EL4.1 | 1:1.0.6-0.EL4.1 |
What each source reports
NVD Score used
Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.
- Record
CVE-2005-2922- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.
- Record
CVE-2005-2922- Updated
- 2026-11-02
EUVDEUVD-2005-2922No score
Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.
- Record
EUVD-2005-2922- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8fj-r9j2-qg46No score
Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions...
Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.
- Record
GHSA-w8fj-r9j2-qg46- Weakness
- CWE-119
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
service.real.com/realplayer/security/03162006_player/en
secunia.com/advisories/19358
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11444
novell.com/linux/security/advisories/2006_18_realplayer.html
vupen.com/english/advisories/2006/1057
securitytracker.com/id?1015808
Show 23 moreShow less
redhat.com/support/errata/RHSA-2005-788.html
exchange.xforce.ibmcloud.com/vulnerabilities/25409
securityfocus.com/bid/17202
kb.cert.org/vuls/id/172489
nvd.nist.gov/vuln/detail/CVE-2005-2922
github.com/advisories/GHSA-w8fj-r9j2-qg46
access.redhat.com/errata/RHSA-2005:788
bugzilla.redhat.com/show_bug.cgi?id=168078
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_788.json
cve.org/CVERecord?id=CVE-2005-2629