RHSA-2016:1238 - Security Advisory

Topic

An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of
Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.

This update upgrades Flash Player to version 11.2.202.626.

Security Fix(es):

• This update fixes multiple vulnerabilities in Adobe Flash Player. These

vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted SWF
file that would cause flash-plugin to crash, execute arbitrary code, or disclose
sensitive information when the victim loaded a page containing the malicious SWF
content. (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125,
CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131,
CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135, CVE-2016-4136,
CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140, CVE-2016-4141,
CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145, CVE-2016-4146,
CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150, CVE-2016-4151,
CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156,
CVE-2016-4166, CVE-2016-4171)

Solution

For details on how to apply this update, which includes the changes described in
this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386

Fixes

• BZ - 1346665 - flash-plugin: multiple code execution issues fixed in APSB16-18

CVEs

• CVE-2016-4149
• CVE-2016-4148
• CVE-2016-4147
• CVE-2016-4146
• CVE-2016-4145
• CVE-2016-4144
• CVE-2016-4143
• CVE-2016-4142
• CVE-2016-4141
• CVE-2016-4140
• CVE-2016-4129
• CVE-2016-4128
• CVE-2016-4166
• CVE-2016-4125
• CVE-2016-4124
• CVE-2016-4127
• CVE-2016-4123
• CVE-2016-4122
• CVE-2016-4150
• CVE-2016-4151
• CVE-2016-4152
• CVE-2016-4153
• CVE-2016-4154
• CVE-2016-4155
• CVE-2016-4156
• CVE-2016-4171
• CVE-2016-4138
• CVE-2016-4139
• CVE-2016-4136
• CVE-2016-4137
• CVE-2016-4134
• CVE-2016-4135
• CVE-2016-4132
• CVE-2016-4133
• CVE-2016-4130
• CVE-2016-4131

References

• https://access.redhat.com/security/updates/classification/#critical
• https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
• https://helpx.adobe.com/security/products/flash-player/apsa16-03.html