Live › vulnerability › CVE-2013-0648
Go to dashboardAdobe Flash Player has an unspecified flaw in its ExternalInterface ActionScript functionality. A remote attacker can run arbitrary code by serving crafted SWF content to a victim.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| adobe flash player | vendor | < 10.3.183.67 | 10.3.183.67 |
| adobe flash player | vendor | >= 11.0, < 11.6.602.171 | 11.6.602.171 |
| adobe flash player | vendor | >= 11.0, < 11.2.202.273 | 11.2.202.273 |
| opensuse | vendor | = 11.4 | – |
| opensuse | vendor | = 12.1 | – |
| suse linux enterprise desktop | vendor | = 10 | – |
| suse linux enterprise desktop | vendor | = 11 | – |
| redhat enterprise linux desktop | vendor | = 6.0 | – |
| redhat enterprise linux eus | vendor | = 5.9 | – |
| redhat enterprise linux eus | vendor | = 6.4 | – |
| redhat enterprise linux server | vendor | = 6.0 | – |
| redhat enterprise linux server aus | vendor | = 5.9 | – |
| redhat enterprise linux server aus | vendor | = 6.4 | – |
| redhat enterprise linux workstation | vendor | = 6.0 | – |
| Adobe Flash Player | vendor | – | – |
Check whether any machine has Adobe Flash Player installed, for example via Add/Remove Programs or the Flash Player install directory; unknown for other commands.
Remove Adobe Flash Player, since the product is end-of-life and CISA says users should discontinue use.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
This page as .md · .json · in your agent: get_signal("CVE-2013-0648")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.