RHSA-2016:1865 - Security Advisory

Topic

An update for flash-plugin is now available for Red Hat Enterprise Linux 5
Supplementary and Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of
Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.

This update upgrades Flash Player to version 11.2.202.635.

Security Fix(es):

• This update fixes multiple vulnerabilities in Adobe Flash Player. These

vulnerabilities, detailed in the Adobe Security Bulletin listed in the
References section, could allow an attacker to create a specially crafted SWF
file that would cause flash-plugin to crash, execute arbitrary code, or disclose
sensitive information when the victim loaded a page containing the malicious SWF
content. (CVE-2016-4271, CVE-2016-4272, CVE-2016-4274, CVE-2016-4275,
CVE-2016-4276, CVE-2016-4277, CVE-2016-4278, CVE-2016-4279, CVE-2016-4280,
CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285,
CVE-2016-4287, CVE-2016-6921, CVE-2016-6922, CVE-2016-6923, CVE-2016-6924,
CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930,
CVE-2016-6931, CVE-2016-6932)

Solution

For details on how to apply this update, which includes the changes described in
this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386

Fixes

• BZ - 1375725 - flash-plugin: multiple code execution issues fixed in APSB16-29

CVEs

• CVE-2016-6930
• CVE-2016-6931
• CVE-2016-6932
• CVE-2016-4275
• CVE-2016-4274
• CVE-2016-4277
• CVE-2016-4276
• CVE-2016-4271
• CVE-2016-4272
• CVE-2016-4279
• CVE-2016-4278
• CVE-2016-6927
• CVE-2016-6926
• CVE-2016-6925
• CVE-2016-6924
• CVE-2016-6923
• CVE-2016-6922
• CVE-2016-6921
• CVE-2016-6929
• CVE-2016-4280
• CVE-2016-4281
• CVE-2016-4282
• CVE-2016-4283
• CVE-2016-4284
• CVE-2016-4285
• CVE-2016-4287

References

• https://access.redhat.com/security/updates/classification/#critical
• https://helpx.adobe.com/security/products/flash-player/apsb16-29.html