Security update for Adobe Flash Player

Announcement ID:	SUSE-SU-2015:0722-1
Rating:	important
References:	bsc#927089
Cross-References:	CVE-2015-0346 CVE-2015-0347 CVE-2015-0348 CVE-2015-0349 CVE-2015-0350 CVE-2015-0351 CVE-2015-0352 CVE-2015-0353 CVE-2015-0354 CVE-2015-0355 CVE-2015-0356 CVE-2015-0357 CVE-2015-0358 CVE-2015-0359 CVE-2015-0360 CVE-2015-3038 CVE-2015-3039 CVE-2015-3040 CVE-2015-3041 CVE-2015-3042 CVE-2015-3043 CVE-2015-3044
CVSS scores:
Affected Products:	SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Workstation Extension 12

An update that solves 22 vulnerabilities can now be installed.

Description:

Adobe Flash Player was updated to 11.2.202.457 to fix several security issues that could lead to remote code execution.

An exploit for CVE-2015-3043 was reported to exist in the wild.

The following vulnerabilities were fixed:

• Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
• Type confusion vulnerability that could lead to code execution (CVE-2015-0356).
• Buffer overflow vulnerability that could lead to code execution (CVE-2015-0348).
• Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039).
• Double-free vulnerabilities that could lead to code execution (CVE-2015-0346, CVE-2015-0359).
• Memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
• Security bypass vulnerability that could lead to information disclosure (CVE-2015-3044).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12
  zypper in -t patch SUSE-SLE-DESKTOP-12-2015-167=1
• SUSE Linux Enterprise Workstation Extension 12
  zypper in -t patch SUSE-SLE-WE-12-2015-167=1

Package List:

• SUSE Linux Enterprise Desktop 12 (nosrc x86_64 i586)
  • flash-player-11.2.202.457-80.1
• SUSE Linux Enterprise Desktop 12 (x86_64 i586)
  • flash-player-gnome-11.2.202.457-80.1
• SUSE Linux Enterprise Workstation Extension 12 (nosrc x86_64 i586)
  • flash-player-11.2.202.457-80.1
• SUSE Linux Enterprise Workstation Extension 12 (x86_64 i586)
  • flash-player-gnome-11.2.202.457-80.1

References:

• https://www.suse.com/security/cve/CVE-2015-0346.html
• https://www.suse.com/security/cve/CVE-2015-0347.html
• https://www.suse.com/security/cve/CVE-2015-0348.html
• https://www.suse.com/security/cve/CVE-2015-0349.html
• https://www.suse.com/security/cve/CVE-2015-0350.html
• https://www.suse.com/security/cve/CVE-2015-0351.html
• https://www.suse.com/security/cve/CVE-2015-0352.html
• https://www.suse.com/security/cve/CVE-2015-0353.html
• https://www.suse.com/security/cve/CVE-2015-0354.html
• https://www.suse.com/security/cve/CVE-2015-0355.html
• https://www.suse.com/security/cve/CVE-2015-0356.html
• https://www.suse.com/security/cve/CVE-2015-0357.html
• https://www.suse.com/security/cve/CVE-2015-0358.html
• https://www.suse.com/security/cve/CVE-2015-0359.html
• https://www.suse.com/security/cve/CVE-2015-0360.html
• https://www.suse.com/security/cve/CVE-2015-3038.html
• https://www.suse.com/security/cve/CVE-2015-3039.html
• https://www.suse.com/security/cve/CVE-2015-3040.html
• https://www.suse.com/security/cve/CVE-2015-3041.html
• https://www.suse.com/security/cve/CVE-2015-3042.html
• https://www.suse.com/security/cve/CVE-2015-3043.html
• https://www.suse.com/security/cve/CVE-2015-3044.html
• https://bugzilla.suse.com/show_bug.cgi?id=927089