RCE in Adobe Air

CVE-2013-5332

Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.054 (91.9th percentile) — read the EPSS interpretation.

Affected products

Adobe Air
Adobe Air_sdk
Adobe Flash_player
Apple Mac_os_x
Linux Linux_kernel
Microsoft Windows
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@adobe.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
psirt@adobe.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
psirt@adobe.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
psirt@adobe.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
psirt@adobe.com (x_refsource_CONFIRM, Patch, Vendor Advisory)