CVE-2013-1374

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x. Adobe AIR before 3.6.0.597 and AIR SDK before 3.6.0.599 are also affected [2]. The flaw is triggered via unspecified vectors, likely involving crafted SWF content.

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by convincing a user to open a malicious Flash file, for example through a web page or email attachment. The use-after-free condition is triggered during processing of the crafted content, leading to memory corruption.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected user. This could lead to full system compromise, including data theft, installation of malware, or denial of service [2].

Mitigation

Adobe released updates to address this vulnerability: Flash Player 10.3.183.63/11.6.602.168 (Windows), 10.3.183.61/11.6.602.167 (Mac), 10.3.183.61/11.2.202.270 (Linux), 11.1.111.43 (Android 2.x/3.x), 11.1.115.47 (Android 4.x), AIR 3.6.0.597, and AIR SDK 3.6.0.599 [2]. Red Hat also provided updated packages for Red Hat Enterprise Linux via RHSA-2013-0254 [1]. Users should apply the appropriate updates as soon as possible.