Bug 1015379 (CVE-2016-7867)

Summary:	VUL-0: EMU: flash-player: december 13 release (APSB16-39)
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Marcus Meissner <meissner>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P5 - None	CC:	astieger, sbrabec, simonf.lees
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Marcus Meissner 2016-12-13 16:32:30 UTC

https://helpx.adobe.com/security/products/flash-player/apsb16-39.html



Security updates available for Adobe Flash Player

Release date: December 13, 2016

Vulnerability identifier: APSB16-39

Priority: See table below

CVE number: CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892

Platform: Windows, Macintosh, Linux and Chrome OS
Summary

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS.  These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.  

Adobe is aware of a report that an exploit for CVE-2016-7892 exists in the wild, and is being used in limited, targeted attacks against users running Internet Explorer (32-bit) on Windows.


Vulnerability Details

    These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-7872, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7892). 
    These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870). 
    These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-7871, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876). 
    These updates resolve a security bypass vulnerability (CVE-2016-7890).

Acknowledgments
Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

    Nicolas Joly of Microsoft Vulnerability Research (CVE-2016-7877)
    Wen Guanxing from Pangu LAB working with Trend Micro's Zero Day Initiative (CVE-2016-7867, CVE-2016-7868)
    willJ of Tencent PC Manager (CVE-2016-7876)
    Saber working with Trend Micro's Zero Day Initiative (CVE-2016-7872)
    JieZeng of Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards Program (CVE-2016-7881)
    kurusu nono working with Trend Micro's Zero Day Initiative (CVE-2016-7879)
    Tao Yan(@Ga1ois) of Palo Alto Networks (CVE-2016-7873, CVE-2016-7874)
    bo13oy of CloverSec Labs working with Trend Micro's Zero Day Initiative (CVE-2016-7875, CVE-2016-7878)
    bo13oy of CloverSec Labs working with Trend Micro's Zero Day Initiative and Tao Yan(@Ga1ois) of Palo Alto Networks (CVE-2016-7871)
    Yuki Chen of the 360 Vulcan Team (CVE-2016-7880)
    WanderingGlitch - Trend Micro Zero Day Initiative working with Trend Micro's Zero Day Initiative (CVE-2016-7869, CVE-2016-7870)
    Paulos Yibelo (CVE-2016-7890)
    Anonymously reported (CVE-2016-7892)

Comment 1 Marcus Meissner 2016-12-13 16:33:37 UTC

The fix for Linux is to go to 24.0.0.186, a major version jump.

Comment 2 Stanislav Brabec 2016-12-13 18:24:41 UTC

I just inspected the update.

The new update lacks the standalone player. Or exactly: Adobe stopped to offer standalone player many years ago, but they continued to put new versions in URL https://fpdownload.macromedia.com/pub/flashplayer/updaters/11/flashplayer_11_sa.i386.tar.gz. It was i386 only, x86_64 stopped being updated in 2011. I tried some guesses of the new URL. All failed.

To not break existing setup, I'll keep the old insecure flashplayer binary version 11, exactly as we did for x86_64.

Comment 3 Stanislav Brabec 2016-12-13 19:27:53 UTC

Done.

I adapted update.sh, verified dlopen()ed dependencies, and modified spec file to match the new names.

I also found a new version of the EULA, so I updated it as well.

SLE 12:
https://build.suse.de/request/show/125446

openSUSE 13.2:
https://build.opensuse.org/request/show/445647

Packages were not tested yet.

Comment 4 Simon Lees 2016-12-14 10:13:31 UTC

Update released reassigning to security

Comment 5 Swamp Workflow Management 2016-12-14 14:07:50 UTC

SUSE-SU-2016:3148-1: An update that fixes 17 vulnerabilities is now available.

Category: security (critical)
Bug References: 1015379
CVE References: CVE-2016-7867,CVE-2016-7868,CVE-2016-7869,CVE-2016-7870,CVE-2016-7871,CVE-2016-7872,CVE-2016-7873,CVE-2016-7874,CVE-2016-7875,CVE-2016-7876,CVE-2016-7877,CVE-2016-7878,CVE-2016-7879,CVE-2016-7880,CVE-2016-7881,CVE-2016-7890,CVE-2016-7892
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    flash-player-24.0.0.186-152.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    flash-player-24.0.0.186-152.1

Comment 6 Andreas Stieger 2016-12-15 08:22:35 UTC

release 13.2

Comment 7 Swamp Workflow Management 2016-12-15 12:07:34 UTC

openSUSE-SU-2016:3160-1: An update that fixes 17 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1015379
CVE References: CVE-2016-7867,CVE-2016-7868,CVE-2016-7869,CVE-2016-7870,CVE-2016-7871,CVE-2016-7872,CVE-2016-7873,CVE-2016-7874,CVE-2016-7875,CVE-2016-7876,CVE-2016-7877,CVE-2016-7878,CVE-2016-7879,CVE-2016-7880,CVE-2016-7881,CVE-2016-7890,CVE-2016-7892
Sources used:
openSUSE 13.2 NonFree (src):    flash-player-24.0.0.186-2.121.1