SUSE Security Update: Security update for flash-player
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:0723-1
Rating:             important
References:         #927089 
Cross-References:   CVE-2015-0346 CVE-2015-0347 CVE-2015-0348
                    CVE-2015-0349 CVE-2015-0350 CVE-2015-0351
                    CVE-2015-0352 CVE-2015-0353 CVE-2015-0354
                    CVE-2015-0355 CVE-2015-0356 CVE-2015-0357
                    CVE-2015-0358 CVE-2015-0359 CVE-2015-0360
                    CVE-2015-3038 CVE-2015-3039 CVE-2015-3040
                    CVE-2015-3041 CVE-2015-3042 CVE-2015-3043
                    CVE-2015-3044
Affected Products:
                    SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

   An update that fixes 22 vulnerabilities is now available.
   It includes one version update.

Description:


   Adobe Flash Player was updated to version 11.2.202.457 to fix several
   security issues that could have lead to remote code execution.

   An exploit for CVE-2015-3043 was reported to exist in the wild.

   The following vulnerabilities have been fixed:

       * Memory corruption vulnerabilities that could have lead to code
         execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352,
         CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360,
         CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
       * Type confusion vulnerability that could have lead to code execution
         (CVE-2015-0356).
       * Buffer overflow vulnerability that could have lead to code execution
         (CVE-2015-0348).
       * Use-after-free vulnerabilities that could have lead to code
         execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358,
         CVE-2015-3039).
       * Double-free vulnerabilities that could have lead to code execution
         (CVE-2015-0346, CVE-2015-0359).
       * Memory leak vulnerabilities that could have been used to bypass ASLR
         (CVE-2015-0357, CVE-2015-3040).
       * Security bypass vulnerability that could have lead to information
         disclosure (CVE-2015-3044).

   Security Issues:

       * CVE-2015-0346
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0346>
       * CVE-2015-0347
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0347>
       * CVE-2015-0348
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0348>
       * CVE-2015-0349
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0349>
       * CVE-2015-0350
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0350>
       * CVE-2015-0351
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0351>
       * CVE-2015-0352
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0352>
       * CVE-2015-0353
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0353>
       * CVE-2015-0354
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0354>
       * CVE-2015-0355
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0355>
       * CVE-2015-0356
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0356>
       * CVE-2015-0357
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0357>
       * CVE-2015-0358
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0358>
       * CVE-2015-0359
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0359>
       * CVE-2015-0360
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0360>
       * CVE-2015-3038
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3038>
       * CVE-2015-3039
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3039>
       * CVE-2015-3040
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3040>
       * CVE-2015-3041
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3041>
       * CVE-2015-3042
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3042>
       * CVE-2015-3043
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3043>
       * CVE-2015-3044
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3044>


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-flash-player=10615

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version:
 11.2.202.457]:

      flash-player-11.2.202.457-0.3.1
      flash-player-gnome-11.2.202.457-0.3.1
      flash-player-kde4-11.2.202.457-0.3.1


References:

   https://www.suse.com/security/cve/CVE-2015-0346.html
   https://www.suse.com/security/cve/CVE-2015-0347.html
   https://www.suse.com/security/cve/CVE-2015-0348.html
   https://www.suse.com/security/cve/CVE-2015-0349.html
   https://www.suse.com/security/cve/CVE-2015-0350.html
   https://www.suse.com/security/cve/CVE-2015-0351.html
   https://www.suse.com/security/cve/CVE-2015-0352.html
   https://www.suse.com/security/cve/CVE-2015-0353.html
   https://www.suse.com/security/cve/CVE-2015-0354.html
   https://www.suse.com/security/cve/CVE-2015-0355.html
   https://www.suse.com/security/cve/CVE-2015-0356.html
   https://www.suse.com/security/cve/CVE-2015-0357.html
   https://www.suse.com/security/cve/CVE-2015-0358.html
   https://www.suse.com/security/cve/CVE-2015-0359.html
   https://www.suse.com/security/cve/CVE-2015-0360.html
   https://www.suse.com/security/cve/CVE-2015-3038.html
   https://www.suse.com/security/cve/CVE-2015-3039.html
   https://www.suse.com/security/cve/CVE-2015-3040.html
   https://www.suse.com/security/cve/CVE-2015-3041.html
   https://www.suse.com/security/cve/CVE-2015-3042.html
   https://www.suse.com/security/cve/CVE-2015-3043.html
   https://www.suse.com/security/cve/CVE-2015-3044.html
   https://bugzilla.suse.com/927089
   https://download.suse.com/patch/finder/?keywords=93ace65cf2a9138aed0ed06c86bdb248

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org