High severity · published Feb 27, 2013
CVE-2013-0643
Adobe Flash Player Incorrect Default Permissions Vulnerability
In wildKEV
8.8
CVSS
10.5%
EPSS
Yes
On KEV
Description
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.5% · higher than 96% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 17, 2024
Federal remediation dueOct 8, 2024
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
5.9; 6.4 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
5.9; 6.4 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
FP
Flash Player · Adobe
before 10.3.183.67; 11.0 before 11.6.602.171; 11.0 before 11.2.202.273 · source: NVD, CISA, KEV
LE
Linux Enterprise Desktop · Suse
10; 11 · source: NVD
OP
Opensuse · Opensuse
11.4; 12.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0643
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
http://rhn.redhat.com/errata/RHSA-2013-0574.html
x_refsource_CONFIRM
http://www.adobe.com/support/security/bulletins/apsb13-08.html
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html
vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html
More from Flash Player
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-1019
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2015-5123
Adobe Flash Player Use-After-Free Vulnerability
9.8
CVE-2015-5122
Adobe Flash Player Use-After-Free Vulnerability