CVEvulnerability
CVE-2013-0643
CISA Known Exploited Vulnerability
Adobe Flash Player Incorrect Default Permissions Vulnerability — Adobe Flash Player
Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.
- Added to KEV
- 2024-09-17
- Remediation due
- 2024-10-08
- Ransomware use
- Unknown
- Required action
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Notes
- https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ; https://nvd.nist.gov/vuln/detail/CVE-2013-0643
- Status
- Analyzed
- Published
- 2013-02-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-269
Description
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
Affected configurations
• adobe flash player (< 10.3.183.67)
• adobe flash player (>= 11.0 < 11.6.602.171)
• adobe flash player (>= 11.0 < 11.2.202.273)
• redhat enterprise linux desktop 6.0
• redhat enterprise linux eus 5.9
• redhat enterprise linux eus 6.4
• redhat enterprise linux server 6.0
• redhat enterprise linux server aus 5.9
• redhat enterprise linux server aus 6.4
• redhat enterprise linux workstation 6.0
• opensuse opensuse 11.4
• opensuse opensuse 12.1
• suse linux enterprise desktop 10
• suse linux enterprise desktop 11
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html Mailing List
- http://rhn.redhat.com/errata/RHSA-2013-0574.html Third Party Advisory
- http://www.adobe.com/support/security/bulletins/apsb13-08.html Broken Link, Patch, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html Mailing List
- http://rhn.redhat.com/errata/RHSA-2013-0574.html Third Party Advisory
- http://www.adobe.com/support/security/bulletins/apsb13-08.html Broken Link, Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0643 US Government Resource