Live › vulnerability › CVE-2013-0643
Go to dashboardAdobe Flash Player had an incorrect default permissions flaw in its Firefox sandbox. A remote attacker who gets a victim to load crafted SWF content can run arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| adobe flash player | vendor | < 10.3.183.67 | 10.3.183.67 |
| adobe flash player | vendor | >= 11.0, < 11.6.602.171 | 11.6.602.171 |
| adobe flash player | vendor | >= 11.0, < 11.2.202.273 | 11.2.202.273 |
| redhat enterprise linux desktop | vendor | = 6.0 | – |
| redhat enterprise linux eus | vendor | = 5.9 | – |
| redhat enterprise linux eus | vendor | = 6.4 | – |
| redhat enterprise linux server | vendor | = 6.0 | – |
| redhat enterprise linux server aus | vendor | = 5.9 | – |
| redhat enterprise linux server aus | vendor | = 6.4 | – |
| redhat enterprise linux workstation | vendor | = 6.0 | – |
| opensuse | vendor | = 11.4 | – |
| opensuse | vendor | = 12.1 | – |
| suse linux enterprise desktop | vendor | = 10 | – |
| suse linux enterprise desktop | vendor | = 11 | – |
| Adobe Flash Player | vendor | – | – |
Unknown from the sources.
Remove Adobe Flash Player, which is end-of-life; CISA says users should discontinue use of the product.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
This page as .md · .json · in your agent: get_signal("CVE-2013-0643")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.