Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and AIR can run malicious code

CVE-2013-1379 · published 13 years ago
Summary

Older versions of Adobe Flash Player and Adobe AIR on Windows, macOS, Linux, and Android do not correctly set up internal data structures, which could let an attacker run their own code or crash the application. This risk affects Flash Player versions before 10.3.183.75, 11.x before 11.7.700.169 (or earlier on Linux and Android), and Adobe AIR before 3.7.0.1530. Update to the latest released versions of Flash Player and Adobe AIR to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe adobe_air_sdk <= 3.6.0.6090
3.6.0.599
cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*
adobe flash_player <= 10.3.183.68
6.0.21.0
6.0.79
7.0
7.0.1
7.0.14.0
7.0.19.0
7.0.24.0
7.0.25
7.0.53.0
7.0.60.0
7.0.61.0
153 more version ranges
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe adobe_air <= 3.6.0.6090
3.6.0.597
cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*
novell suse_linux_enterprise_desktop 11.0
cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp2:*:*:*:*:*:*
opensuse opensuse 11.4
12.1
12.2
12.3
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
Original advisory text
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and ...
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 do not properly initialize pointer arrays, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
6% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published10 Apr 2013
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-1379 · NVD
Track software like this
Free during beta