CVE-2013-0644

Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167โ€ฆ

published February 12, 2013

CVSS
โ€”
EPSS
9%
Percentile
95.0
In the wild
Unconfirmed
What it is

๐Ÿšจ A sneaky use-after-free vulnerability in Adobe Flash Player could let attackers execute arbitrary code without breaking a sweat! ๐Ÿ”ฅ Think of this vulnerability like a restaurant that forgets to take a dish off the menu after it's been taken off the table โ€” it still serves up leftovers that can give diners an unpleasant surprise. Just like the chef should double-check their orders, the software needs to handle memory correctly to avoid serving up vulnerabilities. An attacker could exploit this flaw to take control of affected systems, potentially running any code they choose. Imagine someone walking into your home, and because you left the back door open, they take control of your entire smart home โ€” pretty unsettling, right?

Put simply

Think of this vulnerability like a restaurant that forgets to take a dish off the menu after it's been taken off the table โ€” it still serves up leftovers that can give diners an unpleasant surprise. Just like the chef should double-check their orders, the software needs to handle memory correctly to avoid serving up vulnerabilities. This use-after-free vulnerability allows code execution due to improper handling of memory in Adobe Flash Player across multiple operating systems. When memory is freed but still accessed, it can lead to unpredictable behavior and exploitation by malicious actors.

What to do

An attacker could exploit this flaw to take control of affected systems, potentially running any code they choose. Imagine someone walking into your home, and because you left the back door open, they take control of your entire smart home โ€” pretty unsettling, right? To secure your systems, patch Adobe Flash Player to version 10.3.183.63 or later on Windows, or 11.x versions before 11.6.602.168 on other platforms. Ensure that all installations of Adobe AIR are also updated to version 3.6.0.597 or higher. Don't forget to review and tighten your security policies, too! You've got this! By following these steps, you'll reinforce your defenses against this vulnerability. ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08527 ยท 95.0th percentile
Published
2013-02-12T20:00Z
EPSS history
Timeline
  • 12 FEB 20:00Z
    Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167โ€ฆ
    cvelistv5