Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and AIR can let attackers run code

CVE-2013-3328 · published 13 years ago
Summary

Versions of Adobe Flash Player and Adobe AIR (including the AIR SDK) on Windows, macOS, Linux, and Android may allow a malicious actor to run unwanted programs or cause the application to stop working. This risk comes from memory handling errors that could be triggered by specially crafted content. Update to the latest releases of Flash Player, AIR, and the AIR SDK to protect your systems.

What to do
  • Update adobe adobe_air to version 3.7.0.1860 or later.
  • Update adobe adobe_air_sdk to version 3.7.0.1860 or later.
Affected software
VendorProductAffected versions
adobe flash_player < 10.3.183.86
>= 11.0, < 11.7.700.202
>= 11.0, < 11.2.202.285
< 11.1.111.54
< 11.1.115.58
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe adobe_air < 3.7.0.1860
cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*
adobe adobe_air_sdk < 3.7.0.1860
cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 5.9
6.4
cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_eus 5.9
6.4
cpe:2.3:o:redhat:enterprise_linux_server_eus:5.9:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
opensuse opensuse 11.4
12.2
12.3
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
suse linux_enterprise_desktop 10
11
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
Original advisory text
Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and ...
Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published16 May 2013
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2013-3328 · NVD
Track software like this
Free during beta