Bug 1015379 - (CVE-2016-7867) VUL-0: EMU: flash-player: december 13 release (APSB16-39)
(CVE-2016-7867)
VUL-0: EMU: flash-player: december 13 release (APSB16-39)
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P5 - None : Normal
: ---
Assigned To: Security Team bot
Security Team bot
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2016-12-13 16:32 UTC by Marcus Meissner
Modified: 2016-12-15 12:07 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2016-12-13 16:32:30 UTC
https://helpx.adobe.com/security/products/flash-player/apsb16-39.html



Security updates available for Adobe Flash Player

Release date: December 13, 2016

Vulnerability identifier: APSB16-39

Priority: See table below

CVE number: CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892

Platform: Windows, Macintosh, Linux and Chrome OS
Summary

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS.  These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.  

Adobe is aware of a report that an exploit for CVE-2016-7892 exists in the wild, and is being used in limited, targeted attacks against users running Internet Explorer (32-bit) on Windows.


Vulnerability Details

    These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-7872, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7892). 
    These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870). 
    These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-7871, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876). 
    These updates resolve a security bypass vulnerability (CVE-2016-7890).

Acknowledgments
Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

    Nicolas Joly of Microsoft Vulnerability Research (CVE-2016-7877)
    Wen Guanxing from Pangu LAB working with Trend Micro's Zero Day Initiative (CVE-2016-7867, CVE-2016-7868)
    willJ of Tencent PC Manager (CVE-2016-7876)
    Saber working with Trend Micro's Zero Day Initiative (CVE-2016-7872)
    JieZeng of Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards Program (CVE-2016-7881)
    kurusu nono working with Trend Micro's Zero Day Initiative (CVE-2016-7879)
    Tao Yan(@Ga1ois) of Palo Alto Networks (CVE-2016-7873, CVE-2016-7874)
    bo13oy of CloverSec Labs working with Trend Micro's Zero Day Initiative (CVE-2016-7875, CVE-2016-7878)
    bo13oy of CloverSec Labs working with Trend Micro's Zero Day Initiative and Tao Yan(@Ga1ois) of Palo Alto Networks (CVE-2016-7871)
    Yuki Chen of the 360 Vulcan Team (CVE-2016-7880)
    WanderingGlitch - Trend Micro Zero Day Initiative working with Trend Micro's Zero Day Initiative (CVE-2016-7869, CVE-2016-7870)
    Paulos Yibelo (CVE-2016-7890)
    Anonymously reported (CVE-2016-7892)
Comment 1 Marcus Meissner 2016-12-13 16:33:37 UTC
The fix for Linux is to go to 24.0.0.186, a major version jump.
Comment 2 Stanislav Brabec 2016-12-13 18:24:41 UTC
I just inspected the update.

The new update lacks the standalone player. Or exactly: Adobe stopped to offer standalone player many years ago, but they continued to put new versions in URL https://fpdownload.macromedia.com/pub/flashplayer/updaters/11/flashplayer_11_sa.i386.tar.gz. It was i386 only, x86_64 stopped being updated in 2011. I tried some guesses of the new URL. All failed.

To not break existing setup, I'll keep the old insecure flashplayer binary version 11, exactly as we did for x86_64.
Comment 3 Stanislav Brabec 2016-12-13 19:27:53 UTC
Done.

I adapted update.sh, verified dlopen()ed dependencies, and modified spec file to match the new names.

I also found a new version of the EULA, so I updated it as well.

SLE 12:
https://build.suse.de/request/show/125446

openSUSE 13.2:
https://build.opensuse.org/request/show/445647

Packages were not tested yet.
Comment 4 Simon Lees 2016-12-14 10:13:31 UTC
Update released reassigning to security
Comment 5 Swamp Workflow Management 2016-12-14 14:07:50 UTC
SUSE-SU-2016:3148-1: An update that fixes 17 vulnerabilities is now available.

Category: security (critical)
Bug References: 1015379
CVE References: CVE-2016-7867,CVE-2016-7868,CVE-2016-7869,CVE-2016-7870,CVE-2016-7871,CVE-2016-7872,CVE-2016-7873,CVE-2016-7874,CVE-2016-7875,CVE-2016-7876,CVE-2016-7877,CVE-2016-7878,CVE-2016-7879,CVE-2016-7880,CVE-2016-7881,CVE-2016-7890,CVE-2016-7892
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    flash-player-24.0.0.186-152.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    flash-player-24.0.0.186-152.1
Comment 6 Andreas Stieger 2016-12-15 08:22:35 UTC
release 13.2
Comment 7 Swamp Workflow Management 2016-12-15 12:07:34 UTC
openSUSE-SU-2016:3160-1: An update that fixes 17 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1015379
CVE References: CVE-2016-7867,CVE-2016-7868,CVE-2016-7869,CVE-2016-7870,CVE-2016-7871,CVE-2016-7872,CVE-2016-7873,CVE-2016-7874,CVE-2016-7875,CVE-2016-7876,CVE-2016-7877,CVE-2016-7878,CVE-2016-7879,CVE-2016-7880,CVE-2016-7881,CVE-2016-7890,CVE-2016-7892
Sources used:
openSUSE 13.2 NonFree (src):    flash-player-24.0.0.186-2.121.1