1081644 - Firefox is supporting old versions of Real player plug-in

Status: RESOLVED FIXED

(Plugin Check Graveyard :: Whistler, defect, P1)

Description

[Chandra Mohan]

Attachment: Untitled 3.png

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36



Actual results:

Firefox is supporting old version of Real player plug-in which allows remote code execution.

Please find the security vulnerability details:- 

http://service.real.com/realplayer/security/12202013_player/en/
http://service.real.com/realplayer/security/06272014_player/en/

Thanks
Chandra Mohan





Expected results:

Firefox should not support old versions of Real player plug-in.

Comment 1

[Schalk Neethling [:espressive]]

So, in the database we currently have:

(2) RealJukebox NS Plugin
(1) RealNetworks(tm) Chrome Background Extension Plug-In (32-bit)
(3) RealPlayer
(2) RealPlayer Version Plugin
(1) RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)

Looking at each though, they all have the same version set as the latest aka 15.0.2.72 so, I am not sure why we need to track 5 different 'forms' of the plugin. Carsten? I assume historic reasons.

I will update all 5 with the information provided above but, I will need to figure out if there is any reason to track all those individually.

Thanks for reporting this.

Comment 2

[Schalk Neethling [:espressive]]

The production database has been updated. Now I just need to figure out whether we actually need those five different product entries but, that is a separate bug.

Comment 3

[Carsten Book [:Tomcat]]

(In reply to Schalk Neethling [:espressive] from comment #1)
 Carsten? I assume historic reasons.

yep exactly but i guess we can drop outdated/old stuff now

Comment 4

[Benjamin Smedberg]

Do we have Firefox plugin blocks for these versions of realplayer? This got moved to plugincheck, but since plugincheck and the AMO blocklist are separate we need to make sure that we update both of them.

Also, Schalk since this shipped can we remove the security flag?

Comment 5

[Schalk Neethling [:espressive]]

:bsmedberg, I reckon we can. I do not seem to have the needed rights to remove the flag though, so feel free to remove it if you are able. Thanks!

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

There are no blocks for the Real Player plugin. To create a blocklist bug I'll need version and platform details.

Comment 7

[Benjamin Smedberg]

Jorge, do you need more details than the realplayer security bulletins from comment 0?

Comment 8

[Jorge Villalobos [:jorgev] (he/him)]

Sorry for the delay, I filed bug 1222130 to deal with the block.