Security update for flash-player SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0523-1 Final 1 1 2017-02-20T12:06:55Z current 2017-02-20T12:06:55Z 2017-02-20T12:06:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for flash-player The Adobe flash-player was updated to 24.0.0.221 to fix the following issues: Security update to 24.0.0.221 (bsc#1025258), fixing the following vulnerabilities advised under APSB17-04: * type confusion vulnerability that could lead to code execution (CVE-2017-2995). * integer overflow vulnerability that could lead to code execution (CVE-2017-2987). * use-after-free vulnerabilities that could lead to code execution (CVE-2017-2982, CVE-2017-2985, CVE-2017-2993, CVE-2017-2994). * heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017- 2984, CVE-2017-2986, CVE-2017-2992). * memory corruption vulnerabilities that could lead to code execution (CVE-2017-2988, CVE-2017-2990, CVE-2017-2991, CVE-2017-2996). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2017-268,SUSE-SLE-WE-12-SP1-2017-268 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ Link for SUSE-SU-2017:0523-1 https://lists.opensuse.org/opensuse-security-announce/2017-02/msg00034.html E-Mail link for SUSE-SU-2017:0523-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1025258 SUSE Bug 1025258 https://www.suse.com/security/cve/CVE-2017-2982/ SUSE CVE CVE-2017-2982 page https://www.suse.com/security/cve/CVE-2017-2985/ SUSE CVE CVE-2017-2985 page https://www.suse.com/security/cve/CVE-2017-2986/ SUSE CVE CVE-2017-2986 page https://www.suse.com/security/cve/CVE-2017-2987/ SUSE CVE CVE-2017-2987 page https://www.suse.com/security/cve/CVE-2017-2988/ SUSE CVE CVE-2017-2988 page https://www.suse.com/security/cve/CVE-2017-2990/ SUSE CVE CVE-2017-2990 page https://www.suse.com/security/cve/CVE-2017-2991/ SUSE CVE CVE-2017-2991 page https://www.suse.com/security/cve/CVE-2017-2992/ SUSE CVE CVE-2017-2992 page https://www.suse.com/security/cve/CVE-2017-2993/ SUSE CVE CVE-2017-2993 page https://www.suse.com/security/cve/CVE-2017-2994/ SUSE CVE CVE-2017-2994 page https://www.suse.com/security/cve/CVE-2017-2995/ SUSE CVE CVE-2017-2995 page https://www.suse.com/security/cve/CVE-2017-2996/ SUSE CVE CVE-2017-2996 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Workstation Extension 12 SP1 flash-player-24.0.0.221-158.1 flash-player-gnome-24.0.0.221-158.1 flash-player-24.0.0.221-158.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 flash-player-gnome-24.0.0.221-158.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 flash-player-24.0.0.221-158.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 flash-player-gnome-24.0.0.221-158.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP1 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in a routine related to player shutdown. Successful exploitation could lead to arbitrary code execution. CVE-2017-2982 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2982.html CVE-2017-2982 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploitation could lead to arbitrary code execution. CVE-2017-2985 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2985.html CVE-2017-2985 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploitation could lead to arbitrary code execution. CVE-2017-2986 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2986.html CVE-2017-2986 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable integer overflow vulnerability related to Flash Broker COM. Successful exploitation could lead to arbitrary code execution. CVE-2017-2987 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2987.html CVE-2017-2987 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution. CVE-2017-2988 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2988.html CVE-2017-2988 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 decompression routine. Successful exploitation could lead to arbitrary code execution. CVE-2017-2990 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2990.html CVE-2017-2990 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 codec (related to decompression). Successful exploitation could lead to arbitrary code execution. CVE-2017-2991 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2991.html CVE-2017-2991 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could lead to arbitrary code execution. CVE-2017-2992 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2992.html CVE-2017-2992 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution. CVE-2017-2993 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2993.html CVE-2017-2993 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution. CVE-2017-2994 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2994.html CVE-2017-2994 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable type confusion vulnerability related to the MessageChannel class. Successful exploitation could lead to arbitrary code execution. CVE-2017-2995 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2995.html CVE-2017-2995 https://bugzilla.suse.com/1025258 SUSE Bug 1025258 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution. CVE-2017-2996 SUSE Linux Enterprise Desktop 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Desktop 12 SP1:flash-player-gnome-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-24.0.0.221-158.1 SUSE Linux Enterprise Workstation Extension 12 SP1:flash-player-gnome-24.0.0.221-158.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170523-1/ https://www.suse.com/security/cve/CVE-2017-2996.html CVE-2017-2996 https://bugzilla.suse.com/1025258 SUSE Bug 1025258