Security update for flash-player

SUSE Security Update: Security update for flash-player
Announcement ID: SUSE-SU-2015:0723-1
Rating: important
References: #927089
Affected Products:
  • SUSE Linux Enterprise Desktop 11 SP3
    		•

    An update that fixes 22 vulnerabilities is now available. It includes one version update.

    Description:


    Adobe Flash Player was updated to version 11.2.202.457 to fix several
    security issues that could have lead to remote code execution.

    An exploit for CVE-2015-3043 was reported to exist in the wild.

    The following vulnerabilities have been fixed:

    * Memory corruption vulnerabilities that could have lead to code
    execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352,
    CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360,
    CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
    * Type confusion vulnerability that could have lead to code execution
    (CVE-2015-0356).
    * Buffer overflow vulnerability that could have lead to code execution
    (CVE-2015-0348).
    * Use-after-free vulnerabilities that could have lead to code
    execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358,
    CVE-2015-3039).
    * Double-free vulnerabilities that could have lead to code execution
    (CVE-2015-0346, CVE-2015-0359).
    * Memory leak vulnerabilities that could have been used to bypass ASLR
    (CVE-2015-0357, CVE-2015-3040).
    * Security bypass vulnerability that could have lead to information
    disclosure (CVE-2015-3044).

    Security Issues:

    * CVE-2015-0346

    * CVE-2015-0347

    * CVE-2015-0348

    * CVE-2015-0349

    * CVE-2015-0350

    * CVE-2015-0351

    * CVE-2015-0352

    * CVE-2015-0353

    * CVE-2015-0354

    * CVE-2015-0355

    * CVE-2015-0356

    * CVE-2015-0357

    * CVE-2015-0358

    * CVE-2015-0359

    * CVE-2015-0360

    * CVE-2015-3038

    * CVE-2015-3039

    * CVE-2015-3040

    * CVE-2015-3041

    * CVE-2015-3042

    * CVE-2015-3043

    * CVE-2015-3044

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Desktop 11 SP3:
      zypper in -t patch sledsp3-flash-player=10615

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.457]:
      • flash-player-11.2.202.457-0.3.1
      • flash-player-gnome-11.2.202.457-0.3.1
      • flash-player-kde4-11.2.202.457-0.3.1

    References:

    • https://www.suse.com/security/cve/CVE-2015-0346.html
    • https://www.suse.com/security/cve/CVE-2015-0347.html
    • https://www.suse.com/security/cve/CVE-2015-0348.html
    • https://www.suse.com/security/cve/CVE-2015-0349.html
    • https://www.suse.com/security/cve/CVE-2015-0350.html
    • https://www.suse.com/security/cve/CVE-2015-0351.html
    • https://www.suse.com/security/cve/CVE-2015-0352.html
    • https://www.suse.com/security/cve/CVE-2015-0353.html
    • https://www.suse.com/security/cve/CVE-2015-0354.html
    • https://www.suse.com/security/cve/CVE-2015-0355.html
    • https://www.suse.com/security/cve/CVE-2015-0356.html
    • https://www.suse.com/security/cve/CVE-2015-0357.html
    • https://www.suse.com/security/cve/CVE-2015-0358.html
    • https://www.suse.com/security/cve/CVE-2015-0359.html
    • https://www.suse.com/security/cve/CVE-2015-0360.html
    • https://www.suse.com/security/cve/CVE-2015-3038.html
    • https://www.suse.com/security/cve/CVE-2015-3039.html
    • https://www.suse.com/security/cve/CVE-2015-3040.html
    • https://www.suse.com/security/cve/CVE-2015-3041.html
    • https://www.suse.com/security/cve/CVE-2015-3042.html
    • https://www.suse.com/security/cve/CVE-2015-3043.html
    • https://www.suse.com/security/cve/CVE-2015-3044.html
    • https://bugzilla.suse.com/927089
    • https://download.suse.com/patch/finder/?keywords=93ace65cf2a9138aed0ed06c86bdb248