Bug 337204 – <www-plugins/adobe-flash-10.1.85.3: Critical Vulnerabilty (CVE-2010-2884)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Tim Sammut (RETIRED) 2010-09-14 03:26:16 UTC]

From $URL:

A critical  vulnerability exists in Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris, and Adobe Flash Player 10.1.92.10 for Android. This vulnerability also affects Adobe Reader 9.3.4 for Windows, Macintosh and UNIX, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh. This vulnerability (CVE-2010-2884) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against Adobe Flash Player on Windows.

I am creating two bugs--one for www-plugins/adobe-flash, and one for app-text/acroread--so they can be stablized separately since Adobe is planning to release fixed software at different times.

[Comment 1 Daniel Santos 2010-09-18 20:27:43 UTC]

They never cease to amaze do they?

[Comment 2 Tim Sammut (RETIRED) 2010-09-20 18:36:23 UTC]

Adobe has released 10.1.85.3.

"Adobe recommends users of Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, and Solaris update to Adobe Flash Player 10.1.85.3, and users of Adobe Flash Player 10.1.92.10 for Android update to Adobe Flash Player 10.1.95.1."

[Comment 3 Pavel Shirov 2010-09-24 07:39:18 UTC]

*** Bug 338529 has been marked as a duplicate of this bug. ***

[Comment 4 GLSAMaker/CVETool Bot 2010-09-25 16:29:43 UTC]

CVE-2010-2884 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2884):
  Unspecified vulnerability in Adobe Flash Player 10.1.82.76 and earlier for
  Windows, Macintosh, Linux, Solaris; Flash Player 10.1.92.10 for Android;
  Reader 9.3.4 for Windows, Macintosh and UNIX; and Acrobat 9.3.4 and earlier
  for Windows and Macintosh allows remote attackers to cause a denial of
  service (crash) and execute arbitrary code via unknown vectors, as exploited
  in the wild in September 2010.

[Comment 5 Andy Pettinger 2010-09-28 19:11:57 UTC]

Recent Updates
September 27, 2010 — Flash Player "Square" has been updated to include the security enhancements described in Security Bulletin APSB10-22

[Comment 6 Tim Sammut (RETIRED) 2010-10-05 03:11:02 UTC]

Hi, lack, ping.

Do you think you may have time to create a new ebuild for this?

Copying adobe-flash-10.1.82.76-r1.ebuild to adobe-flash-10.1.85.3.ebuild was sufficient on my machine (amd64) to perform the upgrade.

Thanks!

[Comment 7 Jim Ramsay (lack) (RETIRED) 2010-10-13 01:41:23 UTC]

Sorry, sleeping at the switch :)

The good news is that the updated "square" release from Sept 27 was already in the tree, and I hope most people are using that anyway, since it has a native 64-bit version again.

But I have now bumped both the legacy version
  adobe-flash-9.0.283.0.ebuild
And the official release
  adobe-flash-10.1.85.3
To complete our fix for this security vulnerability.

Security team: Please feel free to request stable keywords for adobe-flash-10.1.85.3 at your convenience, no need to wait for any large amount of time for a binary bump like this.  Also, don't bother stabilizing 9.0.283.0, it can stay in testing.

Until the next time...

[Comment 8 Tim Sammut (RETIRED) 2010-10-13 02:53:02 UTC]

Thanks, Jim.

Arches, please test and mark stable:
=www-plugins/adobe-flash-10.1.85.3
Target keywords : "amd64 x86"

[Comment 9 Paweł Hajdan, Jr. (RETIRED) 2010-10-13 06:44:02 UTC]

x86 stable

[Comment 10 Markos Chandras (RETIRED) 2010-10-13 11:29:47 UTC]

amd64 done

[Comment 11 Tim Sammut (RETIRED) 2010-10-13 13:43:54 UTC]

Thanks, folks.

GLSA with bugs 332205 and 322855.

[Comment 12 Tim Sammut (RETIRED) 2011-01-21 17:20:52 UTC]

This is GLSA 201101-09; thank you.