Bug 6384

Summary:	Update request for flash-player-plugin, to 11.2.202.236, mga2
Product:	Mageia	Reporter:	Anssi Hannula <anssi.hannula>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Normal	CC:	geiger.david68210, olivier.delaune, sysadmin-bugs, tmb
Version:	2	Keywords:	Security, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	mga2-64-OK, mga2-32-OK
Source RPM:	flash-player-plugin	CVE:
Status comment:
Bug Depends on:
Bug Blocks:	6385

Description Anssi Hannula 2012-06-09 13:33:47 CEST

Flash Player 11.2.202.236 has been pushed to mga2 nonfree/updates_testing.

Advisory:
============
Adobe Flash Player 11.2.202.236 contains fixes to critical security vulnerabilites found in earlier versions. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

This update resolves various memory corruption (CVE-2012-2034, CVE-2012-2037), stack overflow (CVE-2012-2035), integer overflow (CVE-2012-2036), and null dereference vulnerabilities (CVE-2012-2039) that could lead to code execution.

This update resolves a security bypass vulnerability that could lead to information disclosure (CVE-2012-2038).

Additionally, a packaging issue is fixed which prevented XCB version of libcairo from being used (Mageia bug #5824).

References:
http://www.adobe.com/support/security/bulletins/apsb12-14.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2034
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2035
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2036
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2037
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2038
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2039
https://bugs.mageia.org/show_bug.cgi?id=5824
============

Updated Flash Player 11.2.202.236 packages are in mga2 nonfree/updates_testing
as flash-player-plugin (i586 and x86_64) and flash-player-plugin-kde (i586 and
x86_64).

==========
Suggested testing procedure:
==========
Package installs and Flash works.

Comment 1 Olivier Delaune 2012-06-10 08:50:27 CEST

I tested it by wtacching video on Youtube and also by playing to some flash game. It works fine for me. Mageia 2 64-bits

CC: (none) => olivier.delaune

Comment 2 David GEIGER 2012-06-10 09:31:04 CEST

Testing complete for the srpm flash-player-plugin-11.2.202.236-1.mga2.nonfree.src.rpm on Mageia release 2 (Official) for x86_64,it works fine for me too.

-Some video on Youtube,dailymotion,pluzz ,etc.... ,ok
-Tested flash-player-plugin-kde , ok

CC: (none) => geiger.david68210

Manuel Hiebel 2012-06-10 13:13:24 CEST

Component: RPM Packages => Security
Depends on: (none) => 6385
Whiteboard: (none) => mga2-64-OK,

Manuel Hiebel 2012-06-10 13:13:53 CEST

Depends on: 6385 => (none)

Comment 3 claire robinson 2012-06-10 14:47:35 CEST

Testing complete i586 mga2 with firefox and chromium-browser.
Used global settings in kde to delete the saved data and check for updates.
Tested flash video on youtube.

Running under strace shows it using /usr/lib/libcairo.so.2

$ urpmq --requires --media Release flash-player-plugin | grep cairo

libcairo2

$ urpmq --requires --media Testing flash-player-plugin | grep cairo

libcairo.so.2
libpangocairo-1.0.so.0

Comment 4 claire robinson 2012-06-10 14:49:58 CEST

Validating

Could sysadmin please push from mga2 nonfree/updates_testing to nonfree/updates

See comment 0 for advisory and srpm

Please push this before the mga1 version in bug 6385

Bug 5824 can then be closed as resolved

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Blocks: (none) => 6385
Whiteboard: mga2-64-OK, => mga2-64-OK, mga2-32-OK

Comment 5 Thomas Backlund 2012-06-10 21:05:40 CEST

Update submitted:
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0114

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED