Hi, Version 29.0.0.113 fixes CVE-2018-4919 and CVE-2018-4920. References: https://helpx.adobe.com/security/products/flash-player/apsb18-05.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4919 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4920 Best regards, Nico.
Whiteboard: (none) => MGA6TOOCVE: (none) => CVE-2018-4919, CVE-2018-4920Source RPM: (none) => flash-player-plugin
CC: (none) => marja11Assignee: bugsquad => anssi.hannula
Blocks: (none) => 22820
CC: (none) => pkg-bugs
Updated packages uploaded for cauldron and Mageia 6. Suggested advisory: ======================== Updated packages fix a security vulnerability: It was found that flash versions older than 29.0.0.113 contained a use after free vulnerability that could lead to remote code execution (CVE-2018-4919). A second vulnerability was a type confusion which could also lead to remote code execution (CVE-2018-4920). References: https://helpx.adobe.com/security/products/flash-player/apsb18-05.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4919 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4920 ======================== Updated packages in 6/core/updates_testing: ======================== flash-player-plugin-29.0.0.113-1.mga6 from flash-player-plugin-29.0.0.113-1.mga6.src.rpm
Whiteboard: MGA6TOO => (none)Assignee: anssi.hannula => qa-bugsVersion: Cauldron => 6CC: (none) => mrambo
$ urpmq -i flash-player-plugin|grep ^Source|sort -uV|tail -n 3 Source RPM : flash-player-plugin-28.0.0.137-1.mga6.nonfree.src.rpm Source RPM : flash-player-plugin-28.0.0.161-1.mga6.nonfree.src.rpm Source RPM : flash-player-plugin-29.0.0.113-1.mga6.src.rpm Why is the package being moved from nonfree to core?
Whiteboard: (none) => feedbackCC: (none) => davidwhodgins
(In reply to Dave Hodgins from comment #2) > $ urpmq -i flash-player-plugin|grep ^Source|sort -uV|tail -n 3 > Source RPM : flash-player-plugin-28.0.0.137-1.mga6.nonfree.src.rpm > Source RPM : flash-player-plugin-28.0.0.161-1.mga6.nonfree.src.rpm > Source RPM : flash-player-plugin-29.0.0.113-1.mga6.src.rpm > > Why is the package being moved from nonfree to core? Because I forgot about nonfree. I need to find a way to get that check into my work flow. I'll pull this back from QA until I get it fixed.
Assignee: qa-bugs => mrambo
(In reply to Mike Rambo from comment #3) > (In reply to Dave Hodgins from comment #2) > > $ urpmq -i flash-player-plugin|grep ^Source|sort -uV|tail -n 3 > > Source RPM : flash-player-plugin-28.0.0.137-1.mga6.nonfree.src.rpm > > Source RPM : flash-player-plugin-28.0.0.161-1.mga6.nonfree.src.rpm > > Source RPM : flash-player-plugin-29.0.0.113-1.mga6.src.rpm > > > > Why is the package being moved from nonfree to core? > > Because I forgot about nonfree. I need to find a way to get that check into > my work flow. I'll pull this back from QA until I get it fixed. Simply resubmit it to nonfree... I'll nuke it from core
CC: (none) => tmb
(In reply to Thomas Backlund from comment #4) > > Simply resubmit it to nonfree... > I'll nuke it from core Thanks Thomas. Revised advisory: ======================== Updated packages fix a security vulnerability: It was found that flash versions older than 29.0.0.113 contained a use after free vulnerability that could lead to remote code execution (CVE-2018-4919). A second vulnerability was a type confusion which could also lead to remote code execution (CVE-2018-4920). References: https://helpx.adobe.com/security/products/flash-player/apsb18-05.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4919 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4920 ======================== Updated packages in 6/nonfree/updates_testing: ======================== flash-player-plugin-29.0.0.113-1.mga6 from flash-player-plugin-29.0.0.113-1.mga6.src.rpm
Assignee: mrambo => qa-bugs
Whiteboard: feedback => (none)
Keywords: (none) => advisory
Working ok on Mageia6 x86_64. Validating the update.
Keywords: (none) => validated_updateWhiteboard: (none) => MGA6-64-OKCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0189.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED