CVEvulnerability

CVE-2013-0648

8.8 HIGH Known exploited Published 2013-02-27 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Adobe Flash Player Code Execution Vulnerability — Adobe Flash Player

Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content.

Added to KEV
2024-09-17
Remediation due
2024-10-08
Ransomware use
Unknown
Required action
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Notes
https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ; https://nvd.nist.gov/vuln/detail/CVE-2013-0648
Status
Analyzed
Published
2013-02-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Affected configurations

• adobe flash player (< 10.3.183.67) • adobe flash player (>= 11.0 < 11.6.602.171) • adobe flash player (>= 11.0 < 11.2.202.273) • opensuse opensuse 11.4 • opensuse opensuse 12.1 • suse linux enterprise desktop 10 • suse linux enterprise desktop 11 • redhat enterprise linux desktop 6.0 • redhat enterprise linux eus 5.9 • redhat enterprise linux eus 6.4 • redhat enterprise linux server 6.0 • redhat enterprise linux server aus 5.9 • redhat enterprise linux server aus 6.4 • redhat enterprise linux workstation 6.0

References