Read the docs
TI-2004-01674 Aliases CVE-2004-1798GHSA-qgvq-x96v-cf8x

RealOne player 6.0.11.868 allows remote attackers to execute arbitrary script in the "My…

Priority LOW 28Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

RealOne player 6.0.11.868 allows remote attackers to execute arbitrary script in the "My Computer" zone via a Synchronized Multimedia Integration Language (SMIL) presentation with a "file:javascript:" URL, which is executed in the security context of the previously loaded URL, a different vulnerability than CVE-2003-0726.

Why it matters now

EPSS 0.02189 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:realnetworks:realone_enterprise_desktop:6.0.11.774:*:*:*:*:*:*:*6.0.11.774VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:1.0:*:*:*:*:*:*:*1.0VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:2.0:*:*:*:*:*:*:*2.0VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:6.0.10.505:*:*:*:*:*:*:*6.0.10.505VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:6.0.11.818:*:*:*:*:*:*:*6.0.11.818VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:6.0.11.830:*:*:*:*:*:*:*6.0.11.830VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:6.0.11.841:*:*:*:*:*:*:*6.0.11.841VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:6.0.11.853:*:*:*:*:*:*:*6.0.11.853VulnerableRealNetworks
cpe:2.3:a:realnetworks:realone_player:6.0.11.868:*:*:*:*:*:*:*6.0.11.868VulnerableRealNetworks
cpe:2.3:a:realnetworks:realplayer:8.0:*:*:*:*:*:*:*8.0VulnerableRealNetworks
  • cpe:2.3:a:realnetworks:realone_enterprise_desktop:6.0.11.774:*:*:*:*:*:*:* Versions 6.0.11.774 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:6.0.10.505:*:*:*:*:*:*:* Versions 6.0.10.505 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:6.0.11.818:*:*:*:*:*:*:* Versions 6.0.11.818 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:6.0.11.830:*:*:*:*:*:*:* Versions 6.0.11.830 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:6.0.11.841:*:*:*:*:*:*:* Versions 6.0.11.841 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:6.0.11.853:*:*:*:*:*:*:* Versions 6.0.11.853 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realone_player:6.0.11.868:*:*:*:*:*:*:* Versions 6.0.11.868 Vulnerable ·RealNetworks
  • cpe:2.3:a:realnetworks:realplayer:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·RealNetworks

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-1798
  2. 2026-10-03 Alias added: GHSA-qgvq-x96v-cf8x

References

Patch 1

  • TI-2004-00242 Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne… CVSS 2.0HIGH 9.3
  • TI-2003-01409 Real Networks RealOne Enterprise Desktop 6.0.11.774, RealOne Player 2.0, and RealOne… CVSS 2.0HIGH 10.0
  • TI-2004-00227 Multiple buffer overflows in RealOne Player, RealOne Player 2.0, RealOne Enterprise… CVSS 2.0HIGH 7.6
  • TI-2003-00670 RealOne player allows remote attackers to execute arbitrary script in the "My Computer"… CVSS 2.0MEDIUM 5.1
  • TI-2003-00136 The PNG deflate algorithm in RealOne Player 6.0.11.x and earlier, RealPlayer 8/RealPlayer… CVSS 2.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences