Skip to navigation

Security Advisory Critical: flash-plugin security update

Advisory: RHSA-2011:1144-1
Type: Security Advisory
Severity: Critical
Issued on: 2011-08-10
Last updated on: 2011-08-10
Affected Products: RHEL Desktop Supplementary (v. 5 client)
RHEL Supplementary (v. 5 server)
RHEL Supplementary EUS (v. 5.6.z server)
RHEL Supplementary Long Life (v. 5.6 server)
Red Hat Enterprise Linux Desktop Supplementary (v. 6)
Red Hat Enterprise Linux Server Supplementary (v. 6)
Red Hat Enterprise Linux Server Supplementary EUS (v. 6.1.z)
Red Hat Enterprise Linux Workstation Supplementary (v. 6)
CVEs (cve.mitre.org): CVE-2011-2130
CVE-2011-2134
CVE-2011-2135
CVE-2011-2136
CVE-2011-2137
CVE-2011-2138
CVE-2011-2139
CVE-2011-2140
CVE-2011-2414
CVE-2011-2415
CVE-2011-2416
CVE-2011-2417
CVE-2011-2424
CVE-2011-2425

Details

An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.

This update fixes multiple vulnerabilities in Adobe Flash Player. These
vulnerabilities are detailed on the Adobe security page APSB11-21, listed
in the References section.

Multiple security flaws were found in the way flash-plugin displayed
certain SWF content. An attacker could use these flaws to create a
specially-crafted SWF file that would cause flash-plugin to crash or,
potentially, execute arbitrary code when the victim loaded a page
containing the specially-crafted SWF content. (CVE-2011-2130,
CVE-2011-2134, CVE-2011-2135, CVE-2011-2136, CVE-2011-2137, CVE-2011-2138,
CVE-2011-2139, CVE-2011-2140, CVE-2011-2414, CVE-2011-2415, CVE-2011-2416,
CVE-2011-2417, CVE-2011-2425)

All users of Adobe Flash Player should install this updated package, which
upgrades Flash Player to version 10.3.183.5.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Updated packages

RHEL Desktop Supplementary (v. 5 client)

IA-32:
flash-plugin-10.3.183.5-1.el5.i386.rpm
File outdated by:  RHSA-2014:0380
    MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
x86_64:
flash-plugin-10.3.183.5-1.el5.i386.rpm
File outdated by:  RHSA-2014:0380
    MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
RHEL Supplementary (v. 5 server)

IA-32:
flash-plugin-10.3.183.5-1.el5.i386.rpm
File outdated by:  RHSA-2014:0380
    MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
x86_64:
flash-plugin-10.3.183.5-1.el5.i386.rpm
File outdated by:  RHSA-2014:0380
    MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
RHEL Supplementary EUS (v. 5.6.z server)

IA-32:
flash-plugin-10.3.183.5-1.el5.i386.rpm     MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
x86_64:
flash-plugin-10.3.183.5-1.el5.i386.rpm     MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
RHEL Supplementary Long Life (v. 5.6 server)

IA-32:
flash-plugin-10.3.183.5-1.el5.i386.rpm     MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
x86_64:
flash-plugin-10.3.183.5-1.el5.i386.rpm     MD5: 713fe6bbba58c5cc6c408708ed0cc9ab
SHA-256: 135f928eec78bee1ffe741e57a2b6c6447e808d9c81f11d7f6f7356ffa8796e0
 
Red Hat Enterprise Linux Desktop Supplementary (v. 6)

IA-32:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2014:0380
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
x86_64:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2014:0380
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
Red Hat Enterprise Linux Server Supplementary (v. 6)

IA-32:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2014:0380
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
x86_64:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2014:0380
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
Red Hat Enterprise Linux Server Supplementary EUS (v. 6.1.z)

IA-32:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2011:1445
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
x86_64:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2011:1445
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
Red Hat Enterprise Linux Workstation Supplementary (v. 6)

IA-32:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2014:0380
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
x86_64:
flash-plugin-10.3.183.5-1.el6.i686.rpm
File outdated by:  RHSA-2014:0380
    MD5: 3054602fa5bb9d6f81fbde7bfef51d1c
SHA-256: 354d91327b443f877533e1957f62f21272006743d9889cbe0c2d81b31d8cf099
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

729497 - CVE-2011-2130 CVE-2011-2134 CVE-2011-2135 CVE-2011-2136 CVE-2011-2137 CVE-2011-2138 CVE-2011-2139 CVE-2011-2140 CVE-2011-2414 CVE-2011-2415 CVE-2011-2416 CVE-2011-2417 CVE-2011-2425 flash-plugin: multiple arbitrary code execution flaws (APSB-11-21)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/