Security update for flash-player SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1043-1 Final 1 1 2015-06-11T11:20:08Z current 2015-06-11T11:20:08Z 2015-06-11T11:20:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for flash-player The following issues are fixed by this updated: * CVE-2015-3096: These updates resolve a vulnerability that could be exploited to bypass the fix for CVE-2014-5333. * CVE-2015-3098, CVE-2015-3099, CVE-2015-3102:These updates resolve vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure. * CVE-2015-3100: These updates resolve a stack overflow vulnerability that could lead to code execution. * CVE-2015-3103, CVE-2015-3106, CVE-2015-3107: These updates resolve use-after-free vulnerabilities that could lead to code execution. * CVE-2015-3104: These updates resolve an integer overflow vulnerability that could lead to code execution. * CVE-2015-3105: These updates resolve a memory corruption vulnerability that could lead to code execution. * CVE-2015-3108: These updates resolve a memory leak vulnerability that could be used to bypass ASLR (CVE-2015-3108). (bsc#934088) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-263,SUSE-SLE-WE-12-2015-263 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ Link for SUSE-SU-2015:1043-1 https://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html E-Mail link for SUSE-SU-2015:1043-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/934088 SUSE Bug 934088 https://www.suse.com/security/cve/CVE-2015-3096/ SUSE CVE CVE-2015-3096 page https://www.suse.com/security/cve/CVE-2015-3098/ SUSE CVE CVE-2015-3098 page https://www.suse.com/security/cve/CVE-2015-3099/ SUSE CVE CVE-2015-3099 page https://www.suse.com/security/cve/CVE-2015-3100/ SUSE CVE CVE-2015-3100 page https://www.suse.com/security/cve/CVE-2015-3102/ SUSE CVE CVE-2015-3102 page https://www.suse.com/security/cve/CVE-2015-3103/ SUSE CVE CVE-2015-3103 page https://www.suse.com/security/cve/CVE-2015-3104/ SUSE CVE CVE-2015-3104 page https://www.suse.com/security/cve/CVE-2015-3105/ SUSE CVE CVE-2015-3105 page https://www.suse.com/security/cve/CVE-2015-3106/ SUSE CVE CVE-2015-3106 page https://www.suse.com/security/cve/CVE-2015-3107/ SUSE CVE CVE-2015-3107 page https://www.suse.com/security/cve/CVE-2015-3108/ SUSE CVE CVE-2015-3108 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Workstation Extension 12 flash-player-11.2.202.466-86.1 flash-player-gnome-11.2.202.466-86.1 flash-player-11.2.202.466-86.1 as a component of SUSE Linux Enterprise Desktop 12 flash-player-gnome-11.2.202.466-86.1 as a component of SUSE Linux Enterprise Desktop 12 flash-player-11.2.202.466-86.1 as a component of SUSE Linux Enterprise Workstation Extension 12 flash-player-gnome-11.2.202.466-86.1 as a component of SUSE Linux Enterprise Workstation Extension 12 Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass a CVE-2014-5333 protection mechanism via unspecified vectors. CVE-2015-3096 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3096.html CVE-2015-3096 https://bugzilla.suse.com/934088 SUSE Bug 934088 Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3099 and CVE-2015-3102. CVE-2015-3098 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3098.html CVE-2015-3098 https://bugzilla.suse.com/934088 SUSE Bug 934088 Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3098 and CVE-2015-3102. CVE-2015-3099 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3099.html CVE-2015-3099 https://bugzilla.suse.com/934088 SUSE Bug 934088 Stack-based buffer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors. CVE-2015-3100 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3100.html CVE-2015-3100 https://bugzilla.suse.com/934088 SUSE Bug 934088 Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3098 and CVE-2015-3099. CVE-2015-3102 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3102.html CVE-2015-3102 https://bugzilla.suse.com/934088 SUSE Bug 934088 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3106 and CVE-2015-3107. CVE-2015-3103 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3103.html CVE-2015-3103 https://bugzilla.suse.com/934088 SUSE Bug 934088 Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors. CVE-2015-3104 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3104.html CVE-2015-3104 https://bugzilla.suse.com/934088 SUSE Bug 934088 Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. CVE-2015-3105 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3105.html CVE-2015-3105 https://bugzilla.suse.com/934088 SUSE Bug 934088 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107. CVE-2015-3106 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3106.html CVE-2015-3106 https://bugzilla.suse.com/934088 SUSE Bug 934088 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3106. CVE-2015-3107 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3107.html CVE-2015-3107 https://bugzilla.suse.com/934088 SUSE Bug 934088 https://bugzilla.suse.com/941239 SUSE Bug 941239 Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors. CVE-2015-3108 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.466-86.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.466-86.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151043-1/ https://www.suse.com/security/cve/CVE-2015-3108.html CVE-2015-3108 https://bugzilla.suse.com/934088 SUSE Bug 934088