Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-10-08. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
8 versions affected across 11 products
CVE-2013-0643: CISA added CVE-2013-0643 (Adobe Flash Player) to KEV; Firefox sandbox permission flaw enables RCE via crafted SWF. Flash is EOL — discontinue use.
Post summary
CVE-2013-0643 is a known exploited flaw in Adobe Flash Player; it involves a Firefox sandbox permission issue that can lead to remote code execution via crafted SWF files, and the recommended mitigation is to discontinue Flash use as it is end-of-life.
What happened CISA added CVE-2013-0643 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-09-17, confirming in-the-wild exploitation of this flaw CISA KEV. The vulnerability is an incorrect default permissions issue in the Firefox sandbox for Adobe Flash Player…
Post summary
CISA confirmed that CVE‑2013‑0643 is actively exploited in the wild, labeling it a Known Exploited Vulnerability; the flaw involves incorrect default permissions within Firefox’s sandbox for Adobe Flash Player.
https://research.lyrie.ai/research/active-exploit-cve-2013-0643-flash-player #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The post signals that CVE‑2013‑0643 is actively exploited, though no additional technical or remedial information is provided.
15 of 15 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | adobe | flash_player | - | - | - |
| OS | apple | mac_os_x | - | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |
| OS | opensuse | opensuse | 11.4 | - | - |
| OS | opensuse | opensuse | 12.1 | - | - |
| OS | redhat | enterprise_linux_desktop | 6.0 | - | - |
| OS | redhat | enterprise_linux_eus | 5.9 | - | - |
| OS | redhat | enterprise_linux_eus | 6.4 | - | - |
| OS | redhat | enterprise_linux_server | 6.0 | - | - |
| OS | redhat | enterprise_linux_server_aus | 5.9 | - | - |
| OS | redhat | enterprise_linux_server_aus | 6.4 | - | - |
| OS | redhat | enterprise_linux_workstation | 6.0 | - | - |
| OS | suse | linux_enterprise_desktop | 10 | - | - |
| OS | suse | linux_enterprise_desktop | 11 | - | - |