Mailinglist Archive: opensuse-security-announce (103 mails)

< Previous Next >
[security-announce] SUSE-SU-2016:3148-1: critical: Security update for flash-player
SUSE Security Update: Security update for flash-player
______________________________________________________________________________

Announcement ID: SUSE-SU-2016:3148-1
Rating: critical
References: #1015379
Cross-References: CVE-2016-7867 CVE-2016-7868 CVE-2016-7869
CVE-2016-7870 CVE-2016-7871 CVE-2016-7872
CVE-2016-7873 CVE-2016-7874 CVE-2016-7875
CVE-2016-7876 CVE-2016-7877 CVE-2016-7878
CVE-2016-7879 CVE-2016-7880 CVE-2016-7881
CVE-2016-7890 CVE-2016-7892
Affected Products:
SUSE Linux Enterprise Workstation Extension 12-SP1
SUSE Linux Enterprise Desktop 12-SP1
______________________________________________________________________________

An update that fixes 17 vulnerabilities is now available.

Description:


This update for flash-player fixes the following issues:

- Security update to 24.0.0.186 (bsc#1015379) APSB16-39:
* These updates resolve use-after-free vulnerabilities that could have
lead to code execution (CVE-2016-7872, CVE-2016-7877, CVE-2016-7878,
CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7892).
* These updates resolve buffer overflow vulnerabilities that could
have lead to code execution (CVE-2016-7867, CVE-2016-7868,
CVE-2016-7869, CVE-2016-7870).
* These updates resolve memory corruption vulnerabilities that could
have lead to code execution (CVE-2016-7871, CVE-2016-7873,
CVE-2016-7874, CVE-2016-7875, CVE-2016-7876).
* These updates resolve a security bypass vulnerability
(CVE-2016-7890).
- Keep standalone flashplayer at version 11, no newer version exists
(INSECURE!).
- Update EULA to version 24.0.


Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Workstation Extension 12-SP1:

zypper in -t patch SUSE-SLE-WE-12-SP1-2016-1816=1

- SUSE Linux Enterprise Desktop 12-SP1:

zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1816=1

To bring your system up-to-date, use "zypper patch".


Package List:

- SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64):

flash-player-24.0.0.186-152.1
flash-player-gnome-24.0.0.186-152.1

- SUSE Linux Enterprise Desktop 12-SP1 (x86_64):

flash-player-24.0.0.186-152.1
flash-player-gnome-24.0.0.186-152.1


References:

https://www.suse.com/security/cve/CVE-2016-7867.html
https://www.suse.com/security/cve/CVE-2016-7868.html
https://www.suse.com/security/cve/CVE-2016-7869.html
https://www.suse.com/security/cve/CVE-2016-7870.html
https://www.suse.com/security/cve/CVE-2016-7871.html
https://www.suse.com/security/cve/CVE-2016-7872.html
https://www.suse.com/security/cve/CVE-2016-7873.html
https://www.suse.com/security/cve/CVE-2016-7874.html
https://www.suse.com/security/cve/CVE-2016-7875.html
https://www.suse.com/security/cve/CVE-2016-7876.html
https://www.suse.com/security/cve/CVE-2016-7877.html
https://www.suse.com/security/cve/CVE-2016-7878.html
https://www.suse.com/security/cve/CVE-2016-7879.html
https://www.suse.com/security/cve/CVE-2016-7880.html
https://www.suse.com/security/cve/CVE-2016-7881.html
https://www.suse.com/security/cve/CVE-2016-7890.html
https://www.suse.com/security/cve/CVE-2016-7892.html
https://bugzilla.suse.com/1015379

--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx

< Previous Next >
This Thread
  • No further messages