Bug 1404307 – flash-plugin: multiple code execution issues fixed in APSB16-39

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1404307 - (CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892) flash-plugin: multiple code execution issues fixed in APSB16-39

Summary:	flash-plugin: multiple code execution issues fixed in APSB16-39

Status:	CLOSED ERRATA

Aliases:	CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	urgent Severity urgent
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=critical,public=20161213,repor...
Keywords:	Security

Depends On:	1404311 1404312 1404313
Blocks:	1404310
	Show dependency tree / graph

Reported:	2016-12-13 10:10 EST by Adam Mariš
Modified:	2017-02-01 06:06 EST (History)
CC List:	8 users (show)

See Also:
Fixed In Version:	flash-plugin 24.0.0.186
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-02-01 06:06:50 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:2947	normal	SHIPPED_LIVE	Critical: flash-plugin security update	2016-12-14 13:02:02 EST

Groups: None (edit)

Description Adam Mariš 2016-12-13 10:10:48 EST

Adobe Security Bulletin APSB16-39 for Adobe Flash Player describes multiple flaws that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file.

Quoting from the APSB16-39:

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-7872, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7892).

These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-7871, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876).

These updates resolve a security bypass vulnerability (CVE-2016-7890).

External References:

https://helpx.adobe.com/security/products/flash-player/apsb16-39.html

Comment 2 errata-xmlrpc 2016-12-14 08:02:14 EST

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2016:2947 https://rhn.redhat.com/errata/RHSA-2016-2947.html

Comment 4 Phil Perry 2016-12-26 10:18:02 EST

Are there any plans to fix this in RHEL5?

Comment 5 Tomas Hoger 2017-01-02 04:47:41 EST

New Flash version is no longer compatible with Red Hat Enterprise Linux 5, see bug 1404590.

Note You need to log in before you can comment on or make changes to this bug.