CVE-2013-0643
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
do firstThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Can a WAF block it? No. The vulnerability is triggered by crafted SWF content, which is not delivered via HTTP but through other means such as embedded Flash files. Therefore, a web application firewall cannot filter or block the attack based on HTTP requests.
Also consider: patch
Based on an AI reading of the CVE description, and no vendor rule found yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Is CVE-2013-0643 being exploited?
Yes. CVE-2013-0643 appears in CISA's Known Exploited Vulnerabilities catalog, which means exploitation in the wild has been confirmed and reported. Treat it as active rather than theoretical, and patch it ahead of higher-scoring vulnerabilities that carry no exploitation evidence.
How severe is CVE-2013-0643?
CVE-2013-0643 is rated High with a CVSS score of 8.8. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2013-0643?
Yes. A fix has been recorded for CVE-2013-0643. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2013-0643 affect?
CVE-2013-0643 affects adobe:flash_player, redhat:enterprise_linux_desktop, redhat:enterprise_linux_eus, redhat:enterprise_linux_server, and 4 further products or versions. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
cisa ssvc
- exploitation
- active
- automatable
- no
- technical impact
- total
Assessed by CISA 20 Sept 2024 (SSVC 2.0.3).
timeline
- 27 Feb 2013Published
- 17 Sept 2024Added to CISA KEV (exploited in the wild) · 4,220 days (about 12 years) later
- 20 Sept 2024CISA SSVC assessment: exploitation active · 3 days later
- 8 Oct 2024CISA remediation due date (US federal agencies) · 18 days later
- 22 Oct 2025CVE record last updated · 379 days (about 1 year) later
- 2 Nov 2026Analysed by vulneraibility.com · 377 days (about 1 year) later
- Advisoryrhn.redhat.com /errata/RHSA-2013-0574.html
- Advisorylists.opensuse.org /opensuse-security-announce/2013-02/msg00035.html
- Advisorylists.opensuse.org /opensuse-security-announce/2013-02/msg00025.html
- Advisorylists.opensuse.org /opensuse-security-announce/2013-02/msg00026.html
- Linkadobe.com /support/security/bulletins/apsb13-08.html
- Linkcisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0643
sources
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- CISA KEV catalog: exploitation, date added, due date
- CISA Vulnrichment (ADP): SSVC decision points
- FIRST EPSS: exploit probability and percentile
- Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.