Bug 14456 - Security update request for flash-player-plugin, to 11.2.202.411
Summary: Security update request for flash-player-plugin, to 11.2.202.411
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://helpx.adobe.com/security/produ...
Whiteboard: MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32...
Keywords: validated_update
Depends on: 14506
Blocks:
  Show dependency treegraph
 
Reported: 2014-11-04 17:57 CET by Anssi Hannula
Modified: 2014-11-14 04:41 CET (History)
5 users (show)

See Also:
Source RPM: flash-player-plugin
CVE: CVE-2014-0558, CVE-2014-0564, CVE-2014-0569
Status comment:


Attachments

Description Anssi Hannula 2014-11-04 17:57:34 CET
Advisory:
============
Adobe Flash Player 11.2.202.411 contains fixes to critical security 
vulnerabilities found in earlier versions that could potentially allow an 
attacker to take control of the affected system.

This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2014-0564, CVE-2014-0558).

This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2014-0569).

References:
http://helpx.adobe.com/security/products/flash-player/apsb14-22.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0558
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0569
============

Updated Flash Player 11.2.202.411 packages are in mga3+mga4
nonfree/updates_testing.

Source packages:
flash-player-plugin-11.2.202.411-1.mga3.nonfree
flash-player-plugin-11.2.202.411-1.mga4.nonfree

Binary packages:
flash-player-plugin-11.2.202.411-1.mga3.nonfree
flash-player-plugin-kde-11.2.202.411-1.mga3.nonfree
flash-player-plugin-11.2.202.411-1.mga4.nonfree
flash-player-plugin-kde-11.2.202.411-1.mga4.nonfree
Anssi Hannula 2014-11-04 17:57:48 CET

Whiteboard: (none) => MGA3TOO

Comment 1 David Walser 2014-11-04 20:16:25 CET
Tested successfully on Mageia 3 i586 and Mageia 4 i586.

Whiteboard: MGA3TOO => MGA3TOO MGA3-32-OK MGA4-32-OK

Comment 2 David GEIGER 2014-11-07 07:35:55 CET
Tested mga4_64,

Testing complete for the new flash-player-plugin-11.2.202.411-1.mga4.nonfree, Ok for me and all flash-player test seems to work properly.

flash-player-plugin-11.2.202.411-1.mga4.nonfree
flash-player-plugin-kde-11.2.202.411-1.mga4.nonfree

CC: (none) => geiger.david68210
Whiteboard: MGA3TOO MGA3-32-OK MGA4-32-OK => MGA3TOO MGA3-32-OK MGA4-32-OK MGA4-64-OK

Comment 3 Rémi Verschelde 2014-11-07 17:30:49 CET
Advisory uploaded.

CC: (none) => remi
Whiteboard: MGA3TOO MGA3-32-OK MGA4-32-OK MGA4-64-OK => MGA3TOO MGA3-32-OK MGA4-32-OK MGA4-64-OK advisory

Comment 4 olivier charles 2014-11-07 22:01:11 CET
Tested on Mageia3-64,

Before :

You have version 11,2,202,406 installed

Updated testing packages :
- flash-player-plugin-11.2.202.411-1.mga3.nonfree.x86_64
- flash-player-plugin-kde-11.2.202.411-1.mga3.nonfree.x86_64

Verified on Adobe test :

You have version 11,2,202,411 installed

Ran 2 other tests found on web 
https://helpx.adobe.com/flash-player.html
http://www.scottsdaleaz.gov/traffic/roundabouts/test001

which showed flashplayer working and updated version installed.

CC: (none) => olchal
Whiteboard: MGA3TOO MGA3-32-OK MGA4-32-OK MGA4-64-OK advisory => MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory

Comment 5 David Walser 2014-11-07 23:38:07 CET
Sysadmins, please push this to Mageia 3 and Mageia 4 nonfree/updates.

Keywords: Security => validated_update
CC: (none) => sysadmin-bugs

Comment 6 Pascal Terjan 2014-11-14 02:19:40 CET
I guess this is obsoleted by https://bugs.mageia.org/show_bug.cgi?id=14506 ?

CC: (none) => pterjan

Comment 7 Pascal Terjan 2014-11-14 02:34:45 CET
(Also I wonder why this bug was originally not listed by bugzilla, then appeared after I had started publishing 14506, then disappeared again from the search...)
Comment 8 David Walser 2014-11-14 02:42:08 CET
This is now fixed:
http://advisories.mageia.org/MGASA-2014-0448.html

Depends on: (none) => 14506

Comment 9 David Walser 2014-11-14 04:41:20 CET
Oops, forgot to mark it as FIXED.

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.