Security update for flash-player SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1740-1 Final 1 1 2015-10-14T07:34:43Z current 2015-10-14T07:34:43Z 2015-10-14T07:34:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for flash-player flash-player was updated to version 11.2.202.535 to fix 13 security issues (bsc#950169). These security issues were fixed: - A vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-7628). - A defense-in-depth feature in the Flash broker API (CVE-2015-5569). - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-7629, CVE-2015-7631, CVE-2015-7643, CVE-2015-7644). - A buffer overflow vulnerability that could lead to code execution (CVE-2015-7632). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-680,SUSE-SLE-WE-12-2015-680 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ Link for SUSE-SU-2015:1740-1 https://lists.suse.com/pipermail/sle-security-updates/2015-October/001628.html E-Mail link for SUSE-SU-2015:1740-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/950169 SUSE Bug 950169 https://www.suse.com/security/cve/CVE-2015-5569/ SUSE CVE CVE-2015-5569 page https://www.suse.com/security/cve/CVE-2015-7625/ SUSE CVE CVE-2015-7625 page https://www.suse.com/security/cve/CVE-2015-7626/ SUSE CVE CVE-2015-7626 page https://www.suse.com/security/cve/CVE-2015-7627/ SUSE CVE CVE-2015-7627 page https://www.suse.com/security/cve/CVE-2015-7628/ SUSE CVE CVE-2015-7628 page https://www.suse.com/security/cve/CVE-2015-7629/ SUSE CVE CVE-2015-7629 page https://www.suse.com/security/cve/CVE-2015-7630/ SUSE CVE CVE-2015-7630 page https://www.suse.com/security/cve/CVE-2015-7631/ SUSE CVE CVE-2015-7631 page https://www.suse.com/security/cve/CVE-2015-7632/ SUSE CVE CVE-2015-7632 page https://www.suse.com/security/cve/CVE-2015-7633/ SUSE CVE CVE-2015-7633 page https://www.suse.com/security/cve/CVE-2015-7634/ SUSE CVE CVE-2015-7634 page https://www.suse.com/security/cve/CVE-2015-7643/ SUSE CVE CVE-2015-7643 page https://www.suse.com/security/cve/CVE-2015-7644/ SUSE CVE CVE-2015-7644 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Workstation Extension 12 flash-player-11.2.202.535-105.1 flash-player-gnome-11.2.202.535-105.1 flash-player-11.2.202.535-105.1 as a component of SUSE Linux Enterprise Desktop 12 flash-player-gnome-11.2.202.535-105.1 as a component of SUSE Linux Enterprise Desktop 12 flash-player-11.2.202.535-105.1 as a component of SUSE Linux Enterprise Workstation Extension 12 flash-player-gnome-11.2.202.535-105.1 as a component of SUSE Linux Enterprise Workstation Extension 12 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors. CVE-2015-5569 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-5569.html CVE-2015-5569 https://bugzilla.suse.com/950169 SUSE Bug 950169 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634. CVE-2015-7625 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7625.html CVE-2015-7625 https://bugzilla.suse.com/950169 SUSE Bug 950169 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634. CVE-2015-7626 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7626.html CVE-2015-7626 https://bugzilla.suse.com/950169 SUSE Bug 950169 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634. CVE-2015-7627 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7627.html CVE-2015-7627 https://bugzilla.suse.com/950169 SUSE Bug 950169 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors. CVE-2015-7628 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7628.html CVE-2015-7628 https://bugzilla.suse.com/950169 SUSE Bug 950169 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextFormat object with a crafted tabStops property, a different vulnerability than CVE-2015-7631, CVE-2015-7643, and CVE-2015-7644. CVE-2015-7629 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7629.html CVE-2015-7629 https://bugzilla.suse.com/950169 SUSE Bug 950169 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7633, and CVE-2015-7634. CVE-2015-7630 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7630.html CVE-2015-7630 https://bugzilla.suse.com/950169 SUSE Bug 950169 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextLine object with a crafted validity property, a different vulnerability than CVE-2015-7629, CVE-2015-7643, and CVE-2015-7644. CVE-2015-7631 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7631.html CVE-2015-7631 https://bugzilla.suse.com/950169 SUSE Bug 950169 Buffer overflow in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Loader object with a crafted loaderBytes property. CVE-2015-7632 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7632.html CVE-2015-7632 https://bugzilla.suse.com/950169 SUSE Bug 950169 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7634. CVE-2015-7633 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7633.html CVE-2015-7633 https://bugzilla.suse.com/950169 SUSE Bug 950169 Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7633. CVE-2015-7634 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7634.html CVE-2015-7634 https://bugzilla.suse.com/950169 SUSE Bug 950169 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Video object with a crafted deblocking property, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7644. CVE-2015-7643 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7643.html CVE-2015-7643 https://bugzilla.suse.com/950169 SUSE Bug 950169 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7643. CVE-2015-7644 SUSE Linux Enterprise Desktop 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Desktop 12:flash-player-gnome-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-11.2.202.535-105.1 SUSE Linux Enterprise Workstation Extension 12:flash-player-gnome-11.2.202.535-105.1 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151740-1/ https://www.suse.com/security/cve/CVE-2015-7644.html CVE-2015-7644 https://bugzilla.suse.com/950169 SUSE Bug 950169