CVE-2013-0643KEV · OVERDUE

Adobe Flash Player Incorrect Default Permissions Vulnerability

High · published February 27, 2013

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.7th percentile for exploit probability.

744
days past CISA
deadline
CVSS v3.1
8.8
EPSS
11%
Percentile
95.7
In the wild
Confirmed
What it is

🚨 A sneaky flaw in Adobe Flash Player has left a window open for attackers to run wild with just a crafted SWF file! 🔥 Think of it like a poorly designed security system allowing someone unauthorized to waltz right in and access any room in a mansion. If the Flash sandbox isn’t properly restricting privileges, it’s like having a security guard who lets anyone with a fancy invitation wander about freely! An attacker could exploit this vulnerability to execute arbitrary code on your system, leading to devastating consequences like data theft, unauthorized access, or even complete system control. It’s like handing over the keys to your digital vault without realizing it!

Put simply

Think of it like a poorly designed security system allowing someone unauthorized to waltz right in and access any room in a mansion. If the Flash sandbox isn’t properly restricting privileges, it’s like having a security guard who lets anyone with a fancy invitation wander about freely! This vulnerability arises from improper privilege restrictions in the Firefox sandbox of Adobe Flash Player. Attackers can exploit this weakness through crafted SWF content, allowing them to run arbitrary code remotely.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on your system, leading to devastating consequences like data theft, unauthorized access, or even complete system control. It’s like handing over the keys to your digital vault without realizing it! To remediate this, update Adobe Flash Player immediately to version 10.3.183.67 or 11.6.602.171 for Windows and Mac OS X, or version 11.2.202.273 for Linux. Regularly patch your software to keep these vulnerabilities at bay! You've got this! With these updates, you'll be locking down your system tighter than a drum. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.10533 · 95.7th percentile
Published
2013-02-27T00:00Z
KEV added
2024-09-17 · due 2024-10-08
EPSS history
Timeline
  • 17 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 8
    kev
  • 27 FEB 00:00Z
    The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before…
    cvelistv5