What’s Vulnerable › Vulnerabilities
CVE-2013-2555
- Severity: critical (CVSS 10.0 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 8.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2013-03-11 · updated 2026-06-16
- Weakness: CWE-190
Description
Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
Affected products
- Adobe Air: through 3.6.0.6090
- Adobe Flash Player 24.0.0.186 and earlier.: through 11.1.115.48; through 11.1.111.44; from 11.0 through 11.6.602.180; from 11.0 through 11.2.202.275; before 10.3.183.75; through 10.3.183.75 — fixed in 10.3.183.75
- Opensuse: 11.4, 12.1, 12.2, 12.3
- RedHat Enterprise Linux Desktop: 6.0
- RedHat Enterprise Linux Eus: 5.9, 6.4
- RedHat Enterprise Linux Server: 6.0
- RedHat Enterprise Linux Server Aus: 5.9, 6.4
- RedHat Enterprise Linux Workstation: 6.0
- SUSE Linux Enterprise Server 15 SP1: 11-sp2
How to fix
Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 10.3.183.75. Check the vendor advisory for mitigations.
References
- http://archives.neohapsis.com/archives/bugtraq/2013-04/0197.html
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.html
- http://marc.info/?l=bugtraq&m=139455789818399&w=2
- http://rhn.redhat.com/errata/RHSA-2013-0730.html
- http://twitter.com/VUPEN/statuses/309713355466227713
- http://twitter.com/thezdi/statuses/309756927301283840
- http://www.adobe.com/support/security/bulletins/apsb13-11.html
- http://archives.neohapsis.com/archives/bugtraq/2013-04/0197.html
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
Get alerted when CVE-2013-2555 or the next vulnerability affects your stack