Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.2689
Critical: flash-plugin security update
10 November 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: flash-plugin
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2016-7865 CVE-2016-7864 CVE-2016-7863
CVE-2016-7862 CVE-2016-7861 CVE-2016-7860
CVE-2016-7859 CVE-2016-7858 CVE-2016-7857
Reference: ESB-2016.2681
ESB-2016.2680
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2016-2676.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2016:2676-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-2676.html
Issue date: 2016-11-09
CVE Names: CVE-2016-7857 CVE-2016-7858 CVE-2016-7859
CVE-2016-7860 CVE-2016-7861 CVE-2016-7862
CVE-2016-7863 CVE-2016-7864 CVE-2016-7865
=====================================================================
1. Summary:
An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3. Description:
The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.
This update upgrades Flash Player to version 11.2.202.644.
Security Fix(es):
* This update fixes multiple vulnerabilities in Adobe Flash Player. These
vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted
SWF file that would cause flash-plugin to crash, execute arbitrary code, or
disclose sensitive information when the victim loaded a page containing the
malicious SWF content. (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859,
CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864,
CVE-2016-7865)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1393087 - CVE-2016-7857 CVE-2016-7858 CVE-2016-7859 CVE-2016-7860 CVE-2016-7861 CVE-2016-7862 CVE-2016-7863 CVE-2016-7864 CVE-2016-7865 flash-plugin: multiple code execution issues fixed in APSB16-37
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.644-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.644-1.el5_11.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.644-1.el5_11.i386.rpm
x86_64:
flash-plugin-11.2.202.644-1.el5_11.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.644-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.644-1.el6_8.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.644-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.644-1.el6_8.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.644-1.el6_8.i686.rpm
x86_64:
flash-plugin-11.2.202.644-1.el6_8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-7857
https://access.redhat.com/security/cve/CVE-2016-7858
https://access.redhat.com/security/cve/CVE-2016-7859
https://access.redhat.com/security/cve/CVE-2016-7860
https://access.redhat.com/security/cve/CVE-2016-7861
https://access.redhat.com/security/cve/CVE-2016-7862
https://access.redhat.com/security/cve/CVE-2016-7863
https://access.redhat.com/security/cve/CVE-2016-7864
https://access.redhat.com/security/cve/CVE-2016-7865
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb16-37.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFYIttCXlSAg2UNWIIRAs7+AJ4uhdXmCgvUyfKrbxbEK8h8F7CecACfVHys
2JH6zVSN/HN3rbLjXDzZqyI=
=gjDq
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWCPAeIx+lLeg9Ub1AQhYFg/8DOQxsczIllJ0OtfBMHLREUZa8YVQ1pvr
rMLbHFLrsM9SwudgUQRjHtVpTKYxcTx1fFevdy1vQNqJeXTBkfw9NjbDGoC9z4bT
2M8xMabG0yFVuKvCZtyTDEEji904ab+jSVSPoY81KmAo0PRAqmhaTT7tfprcl5mV
GD37RR0s8C8JV89fwNz6gkTGyPE+baBmLqb8pFP26Y3smTXhCbKRLuepex8RkMmQ
pI4jYzFV3vi2hkB7v/Sd2TEVmU/AN0LT3SmWe5TlpaOmiGyF4W+SSon7fBlPdqQL
N2Sy4I0teHZ+m5zJWyIUfbKeM5HQB5CXR4KWjTFFl24UxJ+ciH4c2Nt7RJOmTplg
crQ/Re3M6GEcXPupq1NJ8Mfgig0KsFG1QvPNk/g3PyZOPx5CqdiJtNcNqrM3XwrN
uiekpzuFIrKNbH5rwbffJA36gQq3c38Jy3xkvBOJtCsB3EEh5O9ljId9Tf28bDD5
NIKGQvvuvxAMkePD5YbD5eyyNGsIdapWJWzWblAgpkl5q80mmGwgBG2M/H7tiAPs
mJbMEDS4KEydzNnft4Vp6WP9n8caJn17KENOgUftoWxDuVPIAQDCOpDcZV0EOTWX
iXLnjbqqHkQarHbhT4r3Y3Awzxh1I9RviWFkKbXXcsftq981zLwFiigvvwkwu9uc
uPMy8GwP/tE=
=DiKT
-----END PGP SIGNATURE-----