Bug 1019129

Summary: VUL-0: flash-player: 24.0.0.194 security update (APSB17-02)
Product: [Novell Products] SUSE Security Incidents Reporter: Andreas Stieger <astieger>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Major    
Priority: P5 - None CC: sbrabec
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: CVSSv2:SUSE:CVE-2017-2928:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2930:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2925:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2936:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2931:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2927:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2934:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2937:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2938:4.3:(AV:N/AC:M/Au:N/C:N/I:P/A:N) CVSSv2:SUSE:CVE-2017-2933:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2935:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2926:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:SUSE:CVE-2017-2932:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2935:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2933:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2926:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2934:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2937:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2932:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2938:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2925:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2930:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2928:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2927:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2936:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2017-2931:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Andreas Stieger 2017-01-10 16:32:57 UTC
CVE-2017-2925, CVE-2017-2926, CVE-2017-2927, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931, CVE-2017-2932, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935, CVE-2017-2936, CVE-2017-2937, CVE-2017-2938

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2017-2938).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931).
Comment 1 Andreas Stieger 2017-01-10 18:15:19 UTC
submitted
Comment 2 Bernhard Wiedemann 2017-01-10 19:00:49 UTC
This is an autogenerated message for OBS integration:
This bug (1019129) was mentioned in
https://build.opensuse.org/request/show/449583 13.2:NonFree / flash-player
Comment 4 Andreas Stieger 2017-01-11 16:49:41 UTC
done
Comment 5 Swamp Workflow Management 2017-01-11 20:08:18 UTC
openSUSE-SU-2017:0107-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1019129
CVE References: CVE-2017-2925,CVE-2017-2926,CVE-2017-2927,CVE-2017-2928,CVE-2017-2930,CVE-2017-2931,CVE-2017-2932,CVE-2017-2933,CVE-2017-2934,CVE-2017-2935,CVE-2017-2936,CVE-2017-2937,CVE-2017-2938
Sources used:
openSUSE 13.2 NonFree (src):    flash-player-24.0.0.194-2.124.1
Comment 6 Swamp Workflow Management 2017-01-11 20:08:42 UTC
SUSE-SU-2017:0108-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1019129
CVE References: CVE-2017-2925,CVE-2017-2926,CVE-2017-2927,CVE-2017-2928,CVE-2017-2930,CVE-2017-2931,CVE-2017-2932,CVE-2017-2933,CVE-2017-2934,CVE-2017-2935,CVE-2017-2936,CVE-2017-2937,CVE-2017-2938
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    flash-player-24.0.0.194-155.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    flash-player-24.0.0.194-155.1