CVE-2013-2728

16.05.2013, 11:45

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	10 UNKNOWN	NETWORK	LOW	AV:N/AC:L/Au:N/C:C/I:C/A:C
adobe	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 87%

Vendor	Product	Version
adobe	flash_player	𝑥 < 10.3.183.86
adobe	flash_player	11.0 ≤ 𝑥 < 11.7.700.202
adobe	flash_player	𝑥 < 10.3.183.86
adobe	flash_player	11.0 ≤ 𝑥 < 11.2.202.285
adobe	flash_player	𝑥 < 11.1.111.54
adobe	flash_player	𝑥 < 11.1.115.58
adobe	adobe_air	𝑥 < 3.7.0.1860
adobe	adobe_air_sdk	𝑥 < 3.7.0.1860
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	5.9
redhat	enterprise_linux_eus	6.4
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_eus	5.9
redhat	enterprise_linux_server_eus	6.4
redhat	enterprise_linux_workstation	6.0
opensuse	opensuse	11.4
opensuse	opensuse	12.2
opensuse	opensuse	12.3

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

adobe-flashplugin

raring	Fixed 11.2.202.285-0raring1 released
quantal	Fixed 11.2.202.285-0quantal1 released
precise	Fixed 11.2.202.285-0precise1 released
lucid	ignored

flashplugin-nonfree

raring	Fixed 11.2.202.285ubuntu0.13.04.1 released
quantal	Fixed 11.2.202.285ubuntu0.12.10.1 released
precise	Fixed 11.2.202.285ubuntu0.12.04.1 released
lucid	ignored

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00010.html

http://rhn.redhat.com/errata/RHSA-2013-0825.html

http://secunia.com/advisories/53442

http://www.adobe.com/support/security/bulletins/apsb13-14.html