Log in Start free

Actively exploited · Published Feb 27, 2013 · Assigned by adobe

CVE-2013-0643

High 8.8 Exploited

In plain English

A high-severity privilege mismanagement in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on September 17, 2024). The chance it is exploited in the next 30 days is estimated at 10.5% (higher than 96% of all known vulnerabilities). The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)10.5%top 4.2% of all CVEs
Exploited in the wildYesCISA KEV since Sep 17, 2024
Attack toolingNoneno public tooling known

CISA guidance

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Federal agencies must remediate by Oct 8, 2024.

Official description

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References