SUSE-SU-2016:3148-1: critical: Security update for flash-player

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for flash-player
______________________________________________________________________________

Announcement ID:    SUSE-SU-2016:3148-1
Rating:             critical
References:         #1015379 
Cross-References:   CVE-2016-7867 CVE-2016-7868 CVE-2016-7869
                    CVE-2016-7870 CVE-2016-7871 CVE-2016-7872
                    CVE-2016-7873 CVE-2016-7874 CVE-2016-7875
                    CVE-2016-7876 CVE-2016-7877 CVE-2016-7878
                    CVE-2016-7879 CVE-2016-7880 CVE-2016-7881
                    CVE-2016-7890 CVE-2016-7892
Affected Products:
                    SUSE Linux Enterprise Workstation Extension 12-SP1
                    SUSE Linux Enterprise Desktop 12-SP1
______________________________________________________________________________

   An update that fixes 17 vulnerabilities is now available.

Description:


   This update for flash-player fixes the following issues:

   - Security update to 24.0.0.186 (bsc#1015379) APSB16-39:
       * These updates resolve use-after-free vulnerabilities that could have
         lead to code execution (CVE-2016-7872, CVE-2016-7877, CVE-2016-7878,
         CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7892).
       * These updates resolve buffer overflow vulnerabilities that could
         have lead to code execution (CVE-2016-7867, CVE-2016-7868,
         CVE-2016-7869, CVE-2016-7870).
       * These updates resolve memory corruption vulnerabilities that could
         have lead to code execution (CVE-2016-7871, CVE-2016-7873,
         CVE-2016-7874, CVE-2016-7875, CVE-2016-7876).
       * These updates resolve a security bypass vulnerability
         (CVE-2016-7890).
   - Keep standalone flashplayer at version 11, no newer version exists
     (INSECURE!).
   - Update EULA to version 24.0.


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Workstation Extension 12-SP1:

      zypper in -t patch SUSE-SLE-WE-12-SP1-2016-1816=1

   - SUSE Linux Enterprise Desktop 12-SP1:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1816=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64):

      flash-player-24.0.0.186-152.1
      flash-player-gnome-24.0.0.186-152.1

   - SUSE Linux Enterprise Desktop 12-SP1 (x86_64):

      flash-player-24.0.0.186-152.1
      flash-player-gnome-24.0.0.186-152.1


References:

   https://www.suse.com/security/cve/CVE-2016-7867.html
   https://www.suse.com/security/cve/CVE-2016-7868.html
   https://www.suse.com/security/cve/CVE-2016-7869.html
   https://www.suse.com/security/cve/CVE-2016-7870.html
   https://www.suse.com/security/cve/CVE-2016-7871.html
   https://www.suse.com/security/cve/CVE-2016-7872.html
   https://www.suse.com/security/cve/CVE-2016-7873.html
   https://www.suse.com/security/cve/CVE-2016-7874.html
   https://www.suse.com/security/cve/CVE-2016-7875.html
   https://www.suse.com/security/cve/CVE-2016-7876.html
   https://www.suse.com/security/cve/CVE-2016-7877.html
   https://www.suse.com/security/cve/CVE-2016-7878.html
   https://www.suse.com/security/cve/CVE-2016-7879.html
   https://www.suse.com/security/cve/CVE-2016-7880.html
   https://www.suse.com/security/cve/CVE-2016-7881.html
   https://www.suse.com/security/cve/CVE-2016-7890.html
   https://www.suse.com/security/cve/CVE-2016-7892.html
   https://bugzilla.suse.com/1015379