Unscored severity · published Mar 11, 2013
CVE-2013-2555
Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before…
–
CVSS
8.5%
EPSS
No
On KEV
Description
Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Air · Adobe
through 3.6.0.6090 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
5.9; 6.4 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
5.9; 6.4 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
FP
Flash Player · Adobe
through 11.1.115.48; through 11.1.111.44; 11.0 through 11.6.602.180; 11.0 through 11.2.202.275; before 10.3.183.75; through 10.3.183.75 · source: NVD
LE
Linux Enterprise Desktop · Suse
11 · source: NVD
OP
Opensuse · Opensuse
11.4; 12.1; 12.2; 12.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2555
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2555
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2013-04/0197.html
Permissions Required
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html
Third Party Advisory
http://marc.info/?l=bugtraq&m=139455789818399&w=2
More from Air
8.8
CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability
8.8
CVE-2015-8651
Adobe Flash Player Integer Overflow Vulnerability
8.8
CVE-2014-8439
Adobe Flash Player Dereferenced Pointer Vulnerability
8.8
CVE-2014-0502
Adobe Flash Player Double Free Vulnerablity
8.8
CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability