openSUSE Security Update: Security update for flash-player ______________________________________________________________________________
Announcement ID: openSUSE-SU-2014:1444-1 Rating: important References: #905032 Cross-References: CVE-2014-0573 CVE-2014-0574 CVE-2014-0576 CVE-2014-0577 CVE-2014-0581 CVE-2014-0582 CVE-2014-0583 CVE-2014-0584 CVE-2014-0585 CVE-2014-0586 CVE-2014-0588 CVE-2014-0589 CVE-2014-0590 CVE-2014-8437 CVE-2014-8438 CVE-2014-8440 CVE-2014-8441 CVE-2014-8442
Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________
An update that fixes 18 vulnerabilities is now available.
Description:
flash-player was updated to version 11.2.202.418 to fix 18 security issues.
These security issues were fixed: - Memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441). - Use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438). - A double free vulnerability that could lead to code execution (CVE-2014-0574). - Type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589). - An information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437). - A heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583). - A permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442).
Patch Instructions:
To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- openSUSE 13.2:NonFree:
zypper in -t patch openSUSE-2014-683
- openSUSE 13.1:NonFree:
zypper in -t patch openSUSE-2014-683
- openSUSE 12.3:NonFree:
zypper in -t patch openSUSE-2014-683
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 13.2:NonFree (i586 x86_64):
flash-player-11.2.202.418-2.11.1 flash-player-gnome-11.2.202.418-2.11.1 flash-player-kde4-11.2.202.418-2.11.1
- openSUSE 13.1:NonFree (i586 x86_64):
flash-player-11.2.202.418-74.1 flash-player-gnome-11.2.202.418-74.1 flash-player-kde4-11.2.202.418-74.1
- openSUSE 12.3:NonFree (i586 x86_64):
flash-player-11.2.202.418-2.100.1 flash-player-gnome-11.2.202.418-2.100.1 flash-player-kde4-11.2.202.418-2.100.1
References:
http://support.novell.com/security/cve/CVE-2014-0573.html http://support.novell.com/security/cve/CVE-2014-0574.html http://support.novell.com/security/cve/CVE-2014-0576.html http://support.novell.com/security/cve/CVE-2014-0577.html http://support.novell.com/security/cve/CVE-2014-0581.html http://support.novell.com/security/cve/CVE-2014-0582.html http://support.novell.com/security/cve/CVE-2014-0583.html http://support.novell.com/security/cve/CVE-2014-0584.html http://support.novell.com/security/cve/CVE-2014-0585.html http://support.novell.com/security/cve/CVE-2014-0586.html http://support.novell.com/security/cve/CVE-2014-0588.html http://support.novell.com/security/cve/CVE-2014-0589.html http://support.novell.com/security/cve/CVE-2014-0590.html http://support.novell.com/security/cve/CVE-2014-8437.html http://support.novell.com/security/cve/CVE-2014-8438.html http://support.novell.com/security/cve/CVE-2014-8440.html http://support.novell.com/security/cve/CVE-2014-8441.html http://support.novell.com/security/cve/CVE-2014-8442.html https://bugzilla.suse.com/show_bug.cgi?id=905032