CVE-2013-0648

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.htmlMailing List
http://rhn.redhat.com/errata/RHSA-2013-0574.htmlThird Party Advisory
http://www.adobe.com/support/security/bulletins/apsb13-08.htmlBroken Link, Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.htmlMailing List
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.htmlMailing List
http://rhn.redhat.com/errata/RHSA-2013-0574.htmlThird Party Advisory
http://www.adobe.com/support/security/bulletins/apsb13-08.htmlBroken Link, Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0648US Government Resource

Timeline

Published: Feb 27, 2013
Last modified: Jun 16, 2026
Added to CISA KEV: Sep 17, 2024
NVD status: Analyzed

Related CVEs from 2013

CVE-2013-064910.0Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x b CVE-2013-065010.0Use-after-free vulnerability in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.CVE-2013-06515.0The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web CVE-2013-06525.0GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows CVE-2013-06534.3Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICI CVE-2013-06549.3CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allow CVE-2013-06559.3The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allo CVE-2013-06566.8Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote a CVE-2013-065710.0Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execut CVE-2013-065810.0Heap-based buffer overflow in RFManagerService.exe in Schneider Electric Accutech Manager 2.00.1 and earlier allows remote attackers to exec CVE-2013-065910.0The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbit CVE-2013-06629.3Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to