CVE-2013-0643: Adobe Flash Player Incorrect Default Permissions Vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-09-17
EPSS: 10.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-02-27 · updated 2026-06-16
Weakness: CWE-269

Description

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Affected products

Adobe Flash Player 24.0.0.186 and earlier.: before 10.3.183.67; from 11.0 before 11.6.602.171; from 11.0 before 11.2.202.273 — fixed in 10.3.183.67, 11.2.202.273, 11.6.602.171
Opensuse: 11.4, 12.1
RedHat Enterprise Linux Desktop: 6.0
RedHat Enterprise Linux Eus: 5.9, 6.4
RedHat Enterprise Linux Server: 6.0
RedHat Enterprise Linux Server Aus: 5.9, 6.4
RedHat Enterprise Linux Workstation: 6.0
SUSE Linux Enterprise Server 15 SP1: 10-sp4, 11-sp2

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 10.3.183.67, 11.2.202.273, 11.6.602.171. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2013-0643 or the next vulnerability affects your stack