CVE-2013-0643: Adobe Flash Player Incorrect Default Permissions Vulnerability
Vulnerability summary
CVE-2013-0643 is a high (CVSS 9.3) Improper Privilege Management vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 17-09-2024. EPSS estimates a 10.53% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-02-2013PublishedVulnerability first disclosed.
- 17-09-2024Added to CISA KEVAdobe Flash Player Incorrect Default Permissions Vulnerability
- 08-10-2024CISA remediation dueThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- 22-10-2025Last modifiedVulnerability information updated.
Description
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
10.53%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 10.53% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 17-09-2024
- Federal due date
- 08-10-2024
CISA required action
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. www.adobe.com/products/flashplayer/end-of-life-alternative.html nvd.nist.gov/vuln/detail/CVE-2013-0643
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat5 products
Adobe1 product
- flash_player< 10.3.183.67 | ≥ 11.0, < 11.6.602.171 | ≥ 11.0, < 11.2.202.273
Opensuse1 product
- opensuseEOL11.4 | 12.1
Suse1 product
- linux_enterprise_desktop10:sp4 | 11:sp2
4 vendors · 8 products
References
6 links- www.adobe.com/support/security/bulletins/apsb13-08.htmlX Refsource CONFIRMBroken LinkPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.htmlVendor AdvisoryX Refsource SUSEMailing List
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing List
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0643Government ResourceUS Government Resource