Security update for flash-playerqemu SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2512-1 Final 1 1 2016-10-12T11:30:42Z current 2016-10-12T11:30:42Z 2016-10-12T11:30:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for flash-playerqemu flash-player was updated to version 11.2.202.637 to fix the following issues (bsc#1004019): CVE-2016-6992: A type confusion vulnerability that could lead to code execution. CVE-2016-6981, CVE-2016-6987: use-after-free vulnerabilities that could lead to code execution CVE-2016-4286: Security bypass vulnerability CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, CVE-2016-6990: Memory corruption vulnerabilities that could lead to code execution Also the EULA was updated to version 23.0 (bsc#1003993). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2016-1468,SUSE-SLE-WE-12-SP1-2016-1468 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ Link for SUSE-SU-2016:2512-1 https://lists.opensuse.org/opensuse-security-announce/2016-10/msg00024.html E-Mail link for SUSE-SU-2016:2512-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1003993 SUSE Bug 1003993 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 https://www.suse.com/security/cve/CVE-2016-4273/ SUSE CVE CVE-2016-4273 page https://www.suse.com/security/cve/CVE-2016-4286/ SUSE CVE CVE-2016-4286 page https://www.suse.com/security/cve/CVE-2016-6981/ SUSE CVE CVE-2016-6981 page https://www.suse.com/security/cve/CVE-2016-6982/ SUSE CVE CVE-2016-6982 page https://www.suse.com/security/cve/CVE-2016-6983/ SUSE CVE CVE-2016-6983 page https://www.suse.com/security/cve/CVE-2016-6984/ SUSE CVE CVE-2016-6984 page https://www.suse.com/security/cve/CVE-2016-6985/ SUSE CVE CVE-2016-6985 page https://www.suse.com/security/cve/CVE-2016-6986/ SUSE CVE CVE-2016-6986 page https://www.suse.com/security/cve/CVE-2016-6987/ SUSE CVE CVE-2016-6987 page https://www.suse.com/security/cve/CVE-2016-6989/ SUSE CVE CVE-2016-6989 page https://www.suse.com/security/cve/CVE-2016-6990/ SUSE CVE CVE-2016-6990 page https://www.suse.com/security/cve/CVE-2016-6992/ SUSE CVE CVE-2016-6992 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Workstation Extension 12 SP1 flash-player-11.2.202.637-143.1 flash-player-gnome-11.2.202.637-143.1 flash-player-11.2.202.637-143.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 flash-player-gnome-11.2.202.637-143.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 flash-player-11.2.202.637-143.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 flash-player-gnome-11.2.202.637-143.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990. CVE-2016-4273 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-4273.html CVE-2016-4273 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to bypass intended access restrictions via unspecified vectors. CVE-2016-4286 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-4286.html CVE-2016-4286 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-6987. CVE-2016-6981 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6981.html CVE-2016-6981 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990. CVE-2016-6982 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6982.html CVE-2016-6982 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990. CVE-2016-6983 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6983.html CVE-2016-6983 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990. CVE-2016-6984 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6984.html CVE-2016-6984 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990. CVE-2016-6985 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6985.html CVE-2016-6985 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6989, and CVE-2016-6990. CVE-2016-6986 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6986.html CVE-2016-6986 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-6981. CVE-2016-6987 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6987.html CVE-2016-6987 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, and CVE-2016-6990. CVE-2016-6989 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6989.html CVE-2016-6989 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, and CVE-2016-6989. CVE-2016-6990 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6990.html CVE-2016-6990 https://bugzilla.suse.com/1004019 SUSE Bug 1004019 Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion." CVE-2016-6992 SUSE Linux Enterprise Desktop 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-11.2.202.637-143.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-11.2.202.637-143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162512-1/ https://www.suse.com/security/cve/CVE-2016-6992.html CVE-2016-6992 https://bugzilla.suse.com/1004019 SUSE Bug 1004019