Bug 13375

Summary:	Security update request for flash-player-plugin, to 11.2.202.359
Product:	Mageia	Reporter:	Anssi Hannula <anssi.hannula>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	sysadmin-bugs, tmb, wrw105
Version:	4	Keywords:	Security, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA3TOO has_procedure advisory mga4-32-ok mga4-64-ok mga3-32-ok mga3-64-ok
Source RPM:	flash-player-plugin	CVE:	CVE-2014-0510, CVE-2014-0516, CVE-2014-0517, CVE-2014-0518, CVE-2014-0519, CVE-2014-0520
Status comment:

Description Anssi Hannula 2014-05-13 23:45:54 CEST

Advisory:
============
Adobe Flash Player 11.2.202.359 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.

This update resolves a use-after-free vulnerability that could result in arbitrary code execution (CVE-2014-0510).

This update resolves a vulnerability that could be used to bypass the same origin policy (CVE-2014-0516).

This update resolves security bypass vulnerabilities (CVE-2014-0517, CVE-2014-0518, CVE-2014-0519, CVE-2014-0520).

References:
http://helpx.adobe.com/security/products/flash-player/apsb14-14.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0510
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0516
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0517
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0518
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0519
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0520
============

Updated Flash Player 11.2.202.359 packages are in mga3+mga4
nonfree/updates_testing.

Source packages:
flash-player-plugin-11.2.202.359-1.mga3.nonfree
flash-player-plugin-11.2.202.359-1.mga4.nonfree

Binary packages:
flash-player-plugin-11.2.202.359-1.mga3.nonfree
flash-player-plugin-kde-11.2.202.359-1.mga3.nonfree
flash-player-plugin-11.2.202.359-1.mga4.nonfree
flash-player-plugin-kde-11.2.202.359-1.mga4.nonfree

Anssi Hannula 2014-05-13 23:46:08 CEST

Whiteboard: (none) => MGA3TOO

Comment 1 Bill Wilkinson 2014-05-14 03:57:56 CEST

Tested mga4-64

Youtube videos, flash game, changed settings in kde front end, all OK, no regressions noted.

CC: (none) => wrw105
Whiteboard: MGA3TOO => MGA3TOO mga4-64-ok

Comment 2 Bill Wilkinson 2014-05-14 04:23:41 CEST

Tested mga3-64 as above, no regressions noted.

As my 32 bit system has an older AMD CPU, I am unable to test the 32-bit versions, so I'll leave them to someone else.

Whiteboard: MGA3TOO mga4-64-ok => MGA3TOO mga4-64-ok mga3-64-ok

Comment 3 claire robinson 2014-05-14 09:40:59 CEST

Well done Bill W, testing the others now.

Comment 4 claire robinson 2014-05-14 09:54:32 CEST

Testing complete mga3 32 & mga4 32

Whiteboard: MGA3TOO mga4-64-ok mga3-64-ok => MGA3TOO has_procedure mga4-32-ok mga4-64-ok mga3-32-ok mga3-64-ok

Comment 5 claire robinson 2014-05-14 10:10:41 CEST

Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure mga4-32-ok mga4-64-ok mga3-32-ok mga3-64-ok => MGA3TOO has_procedure advisory mga4-32-ok mga4-64-ok mga3-32-ok mga3-64-ok
CC: (none) => sysadmin-bugs

Comment 6 Thomas Backlund 2014-05-15 00:21:46 CEST

Update pushed:
http://advisories.mageia.org/MGASA-2014-0219.html

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED