{"id":"CVE-2013-0648","kind":"vulnerability","aliases":["CVE-2013-0648"],"related":[],"title":"Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before…","description":"Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.","summary":"Adobe Flash Player has an unspecified flaw in its ExternalInterface ActionScript functionality. A remote attacker can run arbitrary code by serving crafted SWF content to a victim.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2024-09-17T00:00:00+00:00","products":[{"name":"adobe flash player","fixed":["10.3.183.67"],"affected":"< 10.3.183.67","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["11.6.602.171"],"affected":">= 11.0, < 11.6.602.171","ecosystem":"vendor"},{"name":"adobe flash player","fixed":["11.2.202.273"],"affected":">= 11.0, < 11.2.202.273","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 11.4","ecosystem":"vendor"},{"name":"opensuse","fixed":[],"affected":"= 12.1","ecosystem":"vendor"},{"name":"suse linux enterprise desktop","fixed":[],"affected":"= 10","ecosystem":"vendor"},{"name":"suse linux enterprise desktop","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 5.9","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 6.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 5.9","ecosystem":"vendor"},{"name":"redhat enterprise linux server aus","fixed":[],"affected":"= 6.4","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"Adobe Flash Player","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-flash-player","browsers","exploited","macos","other","windows"],"not_affected_if":["flash-not-installed"],"how_to_check":"Check whether any machine has Adobe Flash Player installed, for example via Add/Remove Programs or the Flash Player install directory; unknown for other commands.","fix":"Remove Adobe Flash Player, since the product is end-of-life and CISA says users should discontinue use.","status":"open","published_at":"2013-02-27T00:55:01+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:08+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T20:58:08Z","model":"claude-haiku-5-5","output":{"fix":"Remove Adobe Flash Player, since the product is end-of-life and CISA says users should discontinue use.","reach":"internet","impact":"high","summary":"Adobe Flash Player has an unspecified flaw in its ExternalInterface ActionScript functionality. A remote attacker can run arbitrary code by serving crafted SWF content to a victim.","category":"other","who_cares":["adobe-flash-player","browsers","windows","macos"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on victim's machine via crafted SWF","analyst_note":"","how_to_check":"Check whether any machine has Adobe Flash Player installed, for example via Add/Remove Programs or the Flash Player install directory; unknown for other commands.","needs_analyst":false,"not_affected_if":["flash-not-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000452,"input_tokens":2833,"output_tokens":337,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0648':14A,17A '-2013':13A,16A '10.3.183.67':118C,132C '11':120C,134C '11.2.202.273':137C '11.6.602.171':123C '2013':158C 'actionscript':6A,89B,111C 'adob':9A,71B,79B,114C 'adobe':18A,21A,24A,67A 'adobe-flash-play':70B 'allow':140C 'arbitrari':96B,145C 'attack':93B,142C 'aus':57A,62A 'browser':74B 'code':97B,146C 'content':102B,150C 'craft':100B,148C 'cve':12A,15A 'desktop':32A,36A,40A 'enterprise':31A,35A,38A,42A,46A,50A,54A,59A,64A 'eus':44A,48A 'execut':144C 'exploit':75B,152C 'externalinterfac':5A,88B,110C 'februari':157C 'flash':10A,19A,22A,25A,68A,72B,80B,115C 'flaw':85B 'function':7A,90B,112C 'linux':30A,34A,39A,43A,47A,51A,55A,60A,65A,139C 'mac':127C 'maco':76B 'opensuse':27A,28A 'os':128C 'player':11A,20A,23A,26A,69A,73B,81B,116C 'redhat':37A,41A,45A,49A,53A,58A,63A 'remot':92B,141C 'run':95B 'serv':99B 'server':52A,56A,61A 'suse':29A,33A 'swf':101B,149C 'unspecifi':1A,84B,106C 'via':147C 'victim':105B 'vulner':2A,107C 'wild':155C 'window':78B,125C 'workstation':66A 'x':121C,129C,135C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-02-27T00:55:01+00:00","kev":{"dateAdded":"2024-09-17","dueDate":"2024-10-08","requiredAction":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-0648","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0648","severity":null,"published_at":"2024-09-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-0648","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0648","severity":null,"published_at":"2013-02-27T00:55:01+00:00","modified_at":"2026-06-16T23:49:50+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}