9.3

CVE-2013-5331

Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified "type confusion," as exploited in the wild in December 2013.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Flash Player Version >= 11.0 < 11.7.700.257
   Apple ≫ macOS X Version-
   Microsoft ≫ Windows Version-
Adobe ≫ Flash Player Version >= 11.8 < 11.8.800.175
   Apple ≫ macOS X Version-
   Microsoft ≫ Windows Version-
Adobe ≫ Flash Player Version >= 11.9 < 11.9.900.700
   Apple ≫ macOS X Version-
   Microsoft ≫ Windows Version-
Adobe ≫ Flash Player Version >= 11.0 < 11.2.202.332
   Linux ≫ Linux Kernel Version-
Adobe ≫ Air Version < 3.9.0.1380
Adobe ≫ Air Sdk Version < 3.9.0.1380
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 87.69% 0.994
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.