Current package is 10.3.181.14, it needs to be updated to 10.3.181.22 An important vulnerability has been identified in Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for Android. This universal cross-site scripting vulnerability (CVE-2011-2107) could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message.
10.3.181.22 is available in nonfree/updates_testing
A new version 10.3.181.26, should resolve CVE-2011-2110, will land in nonfree/updates_testing soon.
Summary: Flash needs to be updated for CVE-2011-2107 => Flash needs to be updated for CVE-2011-2107 and CVE-2011-2110Source RPM: (none) => flash-player-plugin
I've tested 10.3.181.26 on Mageia 1 i586 (using opera and youtube), and it is working. Looks ready for nonfree/updates to me.
CC: (none) => davidwhodgins
CC: (none) => ennael1, qa-bugsAssignee: bugsquad => security
Note that 10.3.181.34 was released June 28th. http://forums.adobe.com/thread/870916
According to that forum post it's not a security update, but it still fixes some bugs. 10.3.181.34 should be in updates_testing soon.
Tested at http://www.adobe.com/software/flash/about/ and youtube.com. Testing complete on i586. Package flash-player-plugin srpm flash-player-plugin-10.3.181.34-0.1.mga1.nonfree.src.rpm When testing on x86-64 is complete, move from Nonfree Updates Testing to Nonfree Updates. Advisory: Flash security update fixing cross-site scripting vulnerability CVE-2011-2107, memory corruption vulnerability CVE-2011-2110, as well as compatibility issues with some content using cross-domain policy files.
There is no x86-64 package, so this can be submitted.
CC: (none) => lists.jjorge
This rpm is only available in the i586 repo. There is no stable 64 bit version of flash-player available from Adobe.
Sorry for my redundant comment. I misunderstood comment 7.
Can someone from the sysadmin team push the package flash-player-plugin srpm flash-player-plugin-10.3.181.34-0.1.mga1.nonfree.src.rpm from Nonfree Updates Testing to Nonfree Updates. (i586 only). with the advisory ... Flash security update fixing cross-site scripting vulnerability CVE-2011-2107, memory corruption vulnerability CVE-2011-2110, as well as compatibility issues with some content using cross-domain policy files.
pushed to updates.
Status: NEW => RESOLVEDCC: (none) => boklmResolution: (none) => FIXED
CC: boklm => (none)