Mageia alert MGASA-2017-0114 (flash-player-plugin)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2017-0114: Updated flash-player-plugin package fixes security vulnerability 
Date:
    	     
 
Fri, 21 Apr 2017 09:24:58 +0200
Message-ID:
    	     
 
<20170421072458.44D009F83E@duvel.mageia.org>
MGASA-2017-0114 - Updated flash-player-plugin package fixes security vulnerability

Publication date: 21 Apr 2017
URL: http://advisories.mageia.org/MGASA-2017-0114.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2017-3058,
     CVE-2017-3059,
     CVE-2017-3060,
     CVE-2017-3061,
     CVE-2017-3062,
     CVE-2017-3063,
     CVE-2017-3064

Description:
This update fixes the following critical security issues:
* use-after-free vulnerabilities that could lead to code execution
  (CVE-2017-3058, CVE-2017-3059, CVE-2017-3062, CVE-2017-3063). 
* memory corruption vulnerabilities that could lead to code execution
  (CVE-2017-3060, CVE-2017-3061, CVE-2017-3064).

References:
- https://bugs.mageia.org/show_bug.cgi?id=20696
- https://helpx.adobe.com/security/products/flash-player/ap...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3058
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3059
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3060
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3061
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3062
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3063
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3064

SRPMS:
- 5/nonfree/flash-player-plugin-25.0.0.148-1.1.mga5.nonfree