CVE-2013-0648

high · 8.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Added 2024-09-17Remediation due 2024-10-08

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

8.8

CVSS

11.1%

EPSS (exploit prob.)

96th

EPSS percentile

2013-02-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
adobe	flash_player	< 10.3.183.67
adobe	flash_player	>= 11.0, < 11.6.602.171
apple	mac_os_x	all versions
microsoft	windows	all versions
adobe	flash_player	>= 11.0, < 11.2.202.273
linux	linux_kernel	all versions
opensuse	opensuse	11.4
opensuse	opensuse	12.1
suse	linux_enterprise_desktop	10
suse	linux_enterprise_desktop	11
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	5.9
redhat	enterprise_linux_eus	6.4
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	5.9
redhat	enterprise_linux_server_aus	6.4
redhat	enterprise_linux_workstation	6.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-0648