CVE-2013-0643highunder attackCWE-269

CVE-2013-0643

Published · Updated

Follow this CVE+ Monitor Flash Player

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 11%
from disclosure to weapon
Published on NVDFeb 27
CISA KEV+4220d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
4 products
Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6)
fix ↗
Action required by CISAfederal deadline: 2024-10-08

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

In short

Adobe Flash Player had a sandbox security flaw that allowed attackers to execute malicious code by tricking users into opening specially crafted Flash files. The sandbox, which is supposed to limit what Flash can do, wasn't working properly.

Technical detail

The Firefox sandbox in Adobe Flash Player before versions 10.3.183.67/11.6.602.171 (Windows/Mac) and 10.3.183.67/11.2.202.273 (Linux) failed to properly enforce privilege restrictions, enabling remote code execution through malicious SWF content. The vulnerability was actively exploited in the wild in February 2013, indicating improper isolation of untrusted Flash content.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a