Bug 20536 - flash-player-plugin security update 25.0.0.127
Summary: flash-player-plugin security update 25.0.0.127
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: advisory MGA5-64-OK MGA5-32-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2017-03-20 11:53 CET by Nicolas Salguero
Modified: 2017-03-25 17:57 CET (History)
3 users (show)

See Also:
Source RPM: flash-player-plugin
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2017-03-20 11:53:47 CET 
Hi,

Version 25.0.0.127 fixes:

A buffer overflow vulnerability that could lead to code execution (CVE-2017-2997).

Memory corruption vulnerabilities that could lead to code execution (CVE-2017-2998, CVE-2017-2999).

A random number generator vulnerability used for constant blinding that could lead to information disclosure (CVE-2017-3000).

Use-after-free vulnerabilities that could lead to code execution (CVE-2017-3001, CVE-2017-3002, CVE-2017-3003).

Reference: https://helpx.adobe.com/security/products/flash-player/apsb17-07.html

Best regards,

Nico.
Nicolas Salguero 2017-03-20 11:54:18 CET

Source RPM: (none) => flash-player-plugin
Whiteboard: (none) => MGA5TOO

Marja Van Waes 2017-03-20 12:11:04 CET

CC: (none) => marja11
Assignee: bugsquad => anssi.hannula

Comment 1 Frédéric "LpSolit" Buclin 2017-03-23 19:48:13 CET 
Flash 25 is already in Cauldron. Could someone backport it to Mageia 5, please? Firefox already blocked several websites due to a too old version of Flash. :(
Comment 2 Rémi Verschelde 2017-03-23 21:34:27 CET 
Will do.

Status: NEW => ASSIGNED
Version: Cauldron => 5
Assignee: anssi.hannula => rverschelde
Whiteboard: MGA5TOO => (none)

Comment 3 Rémi Verschelde 2017-03-23 21:45:31 CET 
Submitted to nonfree/updates_testing:  flash-player-plugin-25.0.0.127-1.mga5

Advisory yet to come.

Assignee: rverschelde => qa-bugs

Comment 4 Dave Hodgins 2017-03-23 22:46:38 CET 
Tested on i586 and x86_64. Advisory added as ...
type: security
subject: Updated flash-player-plugin packages fix security vulnerability
CVE:
 - CVE-2017-2997
 - CVE-2017-2998
 - CVE-2017-2999
 - CVE-2017-3000
 - CVE-2017-3001
 - CVE-2017-3002
 - CVE-2017-3003
src:
  5:
   nonfree:
     - flash-player-plugin-25.0.0.127-1.mga5.nonfree
description: |
  Updated flash-player-plugin installs latest version for the flash plugin
  from adobe. See the referenced security bulletin for details.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=20536
 - https://helpx.adobe.com/security/products/flash-player/apsb17-07.html

Validating the update

Keywords: (none) => validated_update
Whiteboard: (none) => advisory MGA5-64-OK MGA5-32-OK
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 5 Mageia Robot 2017-03-25 17:57:40 CET 
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0087.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.