CVE-2013-0643

high · 8.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Added 2024-09-17Remediation due 2024-10-08

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

8.8

CVSS

10.5%

EPSS (exploit prob.)

96th

EPSS percentile

2013-02-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Affected products

Vendor	Product	Affected versions
adobe	flash_player	< 10.3.183.67
adobe	flash_player	>= 11.0, < 11.6.602.171
apple	mac_os_x	all versions
microsoft	windows	all versions
adobe	flash_player	>= 11.0, < 11.2.202.273
linux	linux_kernel	all versions
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	5.9
redhat	enterprise_linux_eus	6.4
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	5.9
redhat	enterprise_linux_server_aus	6.4
redhat	enterprise_linux_workstation	6.0
opensuse	opensuse	11.4
opensuse	opensuse	12.1
suse	linux_enterprise_desktop	10
suse	linux_enterprise_desktop	11

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-0643