SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1442-1 Rating: important References: #905032 Cross-References: CVE-2014-0573 CVE-2014-0574 CVE-2014-0576 CVE-2014-0577 CVE-2014-0581 CVE-2014-0582 CVE-2014-0583 CVE-2014-0584 CVE-2014-0585 CVE-2014-0586 CVE-2014-0588 CVE-2014-0589 CVE-2014-0590 CVE-2014-8437 CVE-2014-8438 CVE-2014-8440 CVE-2014-8441 CVE-2014-8442 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. It includes one version update. Description: flash-player was updated to version 11.2.202.418 to fix 18 security issues: * Memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441). * Use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438). * A double free vulnerability that could lead to code execution (CVE-2014-0574). * Type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590). * Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589). * An information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437). * A heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583). * A permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442). Further information can be found at http://helpx.adobe.com/security/products/flash-player/apsb14-24.html http://helpx.adobe.com/security/products/flash-player/apsb14-24.html . Security Issues: * CVE-2014-0576 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0576 * CVE-2014-0581 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0581 * CVE-2014-8440 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8440 * CVE-2014-8441 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8441 * CVE-2014-0573 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0573 * CVE-2014-0588 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0588 * CVE-2014-8438 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8438 * CVE-2014-0574 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0574 * CVE-2014-0577 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0577 * CVE-2014-0584 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0584 * CVE-2014-0585 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0585 * CVE-2014-0586 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0586 * CVE-2014-0590 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0590 * CVE-2014-0582 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0582 * CVE-2014-0589 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0589 * CVE-2014-8437 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8437 * CVE-2014-0583 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0583 * CVE-2014-8442 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8442 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9958 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.418]: flash-player-11.2.202.418-0.3.1 flash-player-gnome-11.2.202.418-0.3.1 flash-player-kde4-11.2.202.418-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0573.html http://support.novell.com/security/cve/CVE-2014-0574.html http://support.novell.com/security/cve/CVE-2014-0576.html http://support.novell.com/security/cve/CVE-2014-0577.html http://support.novell.com/security/cve/CVE-2014-0581.html http://support.novell.com/security/cve/CVE-2014-0582.html http://support.novell.com/security/cve/CVE-2014-0583.html http://support.novell.com/security/cve/CVE-2014-0584.html http://support.novell.com/security/cve/CVE-2014-0585.html http://support.novell.com/security/cve/CVE-2014-0586.html http://support.novell.com/security/cve/CVE-2014-0588.html http://support.novell.com/security/cve/CVE-2014-0589.html http://support.novell.com/security/cve/CVE-2014-0590.html http://support.novell.com/security/cve/CVE-2014-8437.html http://support.novell.com/security/cve/CVE-2014-8438.html http://support.novell.com/security/cve/CVE-2014-8440.html http://support.novell.com/security/cve/CVE-2014-8441.html http://support.novell.com/security/cve/CVE-2014-8442.html https://bugzilla.suse.com/show_bug.cgi?id=905032 http://download.suse.com/patch/finder/?keywords=dbcb29ab8a2328939075a141810b... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org