Vulnerability in Adobe Flash Player
CVE-2013-0648
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.111 (95.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.111 · newest: 0.111 · change: 0.000
Affected products
- Adobe Flash Player
- Apple Mac OS X
- Linux Kernel
- Microsoft Windows
- openSUSE — versions 11.4, 12.1
- Red Hat Enterprise Linux Desktop — versions 6.0
- Red Hat Enterprise Linux Eus — versions 5.9, 6.4
- Red Hat Enterprise Linux Server — versions 6.0
- Red Hat Enterprise Linux Server Aus — versions 5.9, 6.4
- Red Hat Enterprise Linux Workstation — versions 6.0
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
References
- rhn.redhat.com/errata/RHSA-2013-0574.html (vendor-advisory, Third Party Advisory)
- www.adobe.com/support/security/bulletins/apsb13-08.html (Patch, Broken Link, Vendor Advisory)
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html (vendor-advisory, Mailing List)
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html (vendor-advisory, Mailing List)
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html (vendor-advisory, Mailing List)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)
Frequently asked questions
- What is CVE-2013-0648?
- CVE-2013-0648 is a high-severity vulnerability in Adobe Flash Player. CVSS score: 8.8/10. Published 2013-02-27.
- How severe is CVE-2013-0648?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2013-0648 known to be exploited?
- Yes. CVE-2013-0648 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-09-17), indicating it is being actively exploited.