CVE-2013-5331 Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380,...
HighCVSS 9.3
EPSS 72.5%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified "type confusion," as exploited in the wild in December 2013.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | >= 11.0, < 11.7.700.257 | 11.7.700.257 |
| Adobe flash player | >= 11.8, < 11.8.800.175 | 11.8.800.175 |
| Adobe flash player | >= 11.9, < 11.9.900.700 | 11.9.900.700 |
| Adobe flash player | >= 11.0, < 11.2.202.332 | 11.2.202.332 |
| Adobe air | < 3.9.0.1380 | 3.9.0.1380 |
| Adobe air sdk | < 3.9.0.1380 | 3.9.0.1380 |
References
- helpx.adobe.com patch vendor-advisory
- SUSE-SU-2013:1896 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2013:1898 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2013:1915 mailing-list third-party-advisory vendor-advisory
- RHSA-2013:1818 third-party-advisory vendor-advisory