Bug 12395

Summary: Security update request for flash-player-plugin, to 11.2.202.335
Product: Mageia Reporter: Anssi Hannula <anssi.hannula>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: normal    
Priority: release_blocker CC: stormi-mageia, sysadmin-bugs, tmb, wrw105
Version: 3Keywords: Security, validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: advisory mga3-64-OK mga3-32-ok
Source RPM: flash-player-plugin CVE:
Status comment:
Bug Depends on:    
Bug Blocks: 11704    

Description Anssi Hannula 2014-01-22 18:45:49 CET 
Advisory:
============
Adobe Flash Player 11.2.202.335 contains fixes to critical security
vulnerabilities found in earlier versions. These vulnerabilities could cause a
crash and potentially allow an attacker to take control of the affected system.

This update resolves a vulnerability that could be used to bypass Flash Player security protections (CVE-2014-0491).

This update resolves an address leak vulnerability that could be used to defeat memory address layout randomization (CVE-2014-0492).

References:
http://helpx.adobe.com/security/products/flash-player/apsb14-02.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-0492
============

Updated Flash Player 11.2.202.335 packages are in mga3 nonfree/updates_testing.

Source packages:
flash-player-plugin-11.2.202.335-1.mga3.nonfree

Binary packages:
flash-player-plugin-11.2.202.335-1.mga3.nonfree
flash-player-plugin-kde-11.2.202.335-1.mga3.nonfree
Comment 1 Bill Wilkinson 2014-01-23 01:27:52 CET 
Tested mga3-64.

viewed several Youtube videos, Changed settings through KDE interface, all OK.

My 32 bit system doesn't work with the latest flash player updates, so someone else will have to check on 32 bit.

CC: (none) => wrw105
Whiteboard: (none) => mga3-64-OK

Comment 2 claire robinson 2014-01-23 09:48:42 CET 
Mga3 32 is ok here. Bill can you give more info please.
claire robinson 2014-01-23 12:40:53 CET

Whiteboard: mga3-64-OK => advisory mga3-64-OK

Comment 3 claire robinson 2014-01-23 13:28:27 CET 
Confirmed with Bill that it fails 32bit for him because he "has one of the older AMD processors that doesn't support one of the compile time options"

Validating

Could syadmin please push from 3 nonfree/updates_testing to updates

Thanks

Keywords: (none) => validated_update
Whiteboard: advisory mga3-64-OK => advisory mga3-64-OK mga3-32-ok
CC: (none) => sysadmin-bugs

Comment 4 Thomas Backlund 2014-01-24 22:12:46 CET 
Update pushed:
http://advisories.mageia.org/MGASA-2014-0029.html

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED

Comment 5 Samuel Verschelde 2014-01-25 14:53:45 CET 
The version in cauldron is lower, missing freeze push?

Priority: Normal => release_blocker
Status: RESOLVED => REOPENED
CC: (none) => stormi
Blocks: (none) => 11704
Resolution: FIXED => (none)

Comment 6 Thomas Backlund 2014-01-25 18:52:02 CET 
submitted to cauldron

Status: REOPENED => RESOLVED
Resolution: (none) => FIXED