CVE-2013-0643
Adobe Flash Player: Incorrect Default Permissions
As of , CVE-2013-0643 in Adobe Flash Player is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 17 September 2024
- US federal deadline
- 8 October 202421 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.11Higher than 95% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.03 on 17 September 2024EPSS on the day CISA listed it.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: www.adobe.comLinks below, from CISA's entry.
What CISA says to do
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA's required action
What the flaw is
Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content.
CISA's description
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
The CVE record's description, from adobe
- CVE published
- 27 February 2013
- Assigned by
- adobe
- CVSS
- 8.8 High (CVSS 3.1, from CISA-ADP)
- CWE-269
- Improper Privilege Management
- CWE-264
- Permissions, Privileges, and Access Controls
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Flash Player: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2014-0497Integer Underflow Vulnerablity | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| CVE-2010-1297Memory Corruption | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.83; verified Exploit-DB entry | 0.83 | ||
| CVE-2011-0609Unspecified | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.64; verified Exploit-DB entry | 0.64 | ||
| CVE-2012-0754Memory Corruption | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.91; verified Exploit-DB entry | 0.91 | ||
| CVE-2015-0311Remote Code Execution | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.86; verified Exploit-DB entry | 0.86 | ||
| CVE-2015-0313Use-After-Free | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.95; verified Exploit-DB entry | 0.95 | ||
| CVE-2015-3113Heap-Based Buffer Overflow | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| CVE-2015-5122Use-After-Free | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.94; verified Exploit-DB entry | 0.94 | ||
| CVE-2011-0611Remote Code Execution | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| CVE-2012-1535Arbitrary Code Execution | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.70; verified Exploit-DB entry | 0.70 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org