Bugzilla – Bug 1015379
VUL-0: EMU: flash-player: december 13 release (APSB16-39)
Last modified: 2016-12-15 12:07:34 UTC
https://helpx.adobe.com/security/products/flash-player/apsb16-39.html Security updates available for Adobe Flash Player Release date: December 13, 2016 Vulnerability identifier: APSB16-39 Priority: See table below CVE number: CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892 Platform: Windows, Macintosh, Linux and Chrome OS Summary Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-7892 exists in the wild, and is being used in limited, targeted attacks against users running Internet Explorer (32-bit) on Windows. Vulnerability Details These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-7872, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7892). These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870). These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-7871, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876). These updates resolve a security bypass vulnerability (CVE-2016-7890). Acknowledgments Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers: Nicolas Joly of Microsoft Vulnerability Research (CVE-2016-7877) Wen Guanxing from Pangu LAB working with Trend Micro's Zero Day Initiative (CVE-2016-7867, CVE-2016-7868) willJ of Tencent PC Manager (CVE-2016-7876) Saber working with Trend Micro's Zero Day Initiative (CVE-2016-7872) JieZeng of Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards Program (CVE-2016-7881) kurusu nono working with Trend Micro's Zero Day Initiative (CVE-2016-7879) Tao Yan(@Ga1ois) of Palo Alto Networks (CVE-2016-7873, CVE-2016-7874) bo13oy of CloverSec Labs working with Trend Micro's Zero Day Initiative (CVE-2016-7875, CVE-2016-7878) bo13oy of CloverSec Labs working with Trend Micro's Zero Day Initiative and Tao Yan(@Ga1ois) of Palo Alto Networks (CVE-2016-7871) Yuki Chen of the 360 Vulcan Team (CVE-2016-7880) WanderingGlitch - Trend Micro Zero Day Initiative working with Trend Micro's Zero Day Initiative (CVE-2016-7869, CVE-2016-7870) Paulos Yibelo (CVE-2016-7890) Anonymously reported (CVE-2016-7892)
The fix for Linux is to go to 24.0.0.186, a major version jump.
I just inspected the update. The new update lacks the standalone player. Or exactly: Adobe stopped to offer standalone player many years ago, but they continued to put new versions in URL https://fpdownload.macromedia.com/pub/flashplayer/updaters/11/flashplayer_11_sa.i386.tar.gz. It was i386 only, x86_64 stopped being updated in 2011. I tried some guesses of the new URL. All failed. To not break existing setup, I'll keep the old insecure flashplayer binary version 11, exactly as we did for x86_64.
Done. I adapted update.sh, verified dlopen()ed dependencies, and modified spec file to match the new names. I also found a new version of the EULA, so I updated it as well. SLE 12: https://build.suse.de/request/show/125446 openSUSE 13.2: https://build.opensuse.org/request/show/445647 Packages were not tested yet.
Update released reassigning to security
SUSE-SU-2016:3148-1: An update that fixes 17 vulnerabilities is now available. Category: security (critical) Bug References: 1015379 CVE References: CVE-2016-7867,CVE-2016-7868,CVE-2016-7869,CVE-2016-7870,CVE-2016-7871,CVE-2016-7872,CVE-2016-7873,CVE-2016-7874,CVE-2016-7875,CVE-2016-7876,CVE-2016-7877,CVE-2016-7878,CVE-2016-7879,CVE-2016-7880,CVE-2016-7881,CVE-2016-7890,CVE-2016-7892 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP1 (src): flash-player-24.0.0.186-152.1 SUSE Linux Enterprise Desktop 12-SP1 (src): flash-player-24.0.0.186-152.1
release 13.2
openSUSE-SU-2016:3160-1: An update that fixes 17 vulnerabilities is now available. Category: security (moderate) Bug References: 1015379 CVE References: CVE-2016-7867,CVE-2016-7868,CVE-2016-7869,CVE-2016-7870,CVE-2016-7871,CVE-2016-7872,CVE-2016-7873,CVE-2016-7874,CVE-2016-7875,CVE-2016-7876,CVE-2016-7877,CVE-2016-7878,CVE-2016-7879,CVE-2016-7880,CVE-2016-7881,CVE-2016-7890,CVE-2016-7892 Sources used: openSUSE 13.2 NonFree (src): flash-player-24.0.0.186-2.121.1