CVE-2013-2555
Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x;…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 8.46% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- adobe/flash player · adobe/air · opensuse/opensuse · suse/linux enterprise desktop · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux workstation
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2013-04/0197.htmlBroken Link
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157Permissions Required
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.htmlMailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=139455789818399&w=2Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0730.htmlThird Party Advisory
- http://twitter.com/VUPEN/statuses/309713355466227713Broken Link
- http://twitter.com/thezdi/statuses/309756927301283840Third Party Advisory
- http://www.adobe.com/support/security/bulletins/apsb13-11.htmlVendor Advisory
- http://archives.neohapsis.com/archives/bugtraq/2013-04/0197.htmlBroken Link
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157Permissions Required
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00016.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00019.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00081.htmlMailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=139455789818399&w=2Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0730.htmlThird Party Advisory
- http://twitter.com/VUPEN/statuses/309713355466227713Broken Link
- http://twitter.com/thezdi/statuses/309756927301283840Third Party Advisory
- http://www.adobe.com/support/security/bulletins/apsb13-11.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.