Bug 602546 (APSB16-39, CVE-2016-7867, CVE-2016-7868, CVE-2016-7869, CVE-2016-7870, CVE-2016-7871, CVE-2016-7872, CVE-2016-7873, CVE-2016-7874, CVE-2016-7875, CVE-2016-7876, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881, CVE-2016-7890, CVE-2016-7892)

Summary:	<www-plugins/adobe-flash-24.0.0.186: Multiple vulnerabilities (APSB16-39)
Product:	Gentoo Security	Reporter:	Thomas Deutschmann (RETIRED) <whissi>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	desktop-misc, jer
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://helpx.adobe.com/security/products/flash-player/apsb16-39.html
Whiteboard:	A2 [glsa cve]
Package list:		Runtime testing required:	---

Description Thomas Deutschmann (RETIRED) gentoo-dev

2016-12-13 14:35:57 UTC

Adobe Security Bulletin not yet available however release notes (https://helpx.adobe.com/flash-player/release-note/fp_24_air_24_release_notes.html) were updated:

> December 13, 2016
> 
> In today's scheduled release, we've updated Flash Player and AIR
> with important bug fixes, security updates, and new features.


Upstream has already released v24.0.0.186. No information regarding v11.x yet.


Bulletin-URL (not yet published): https://helpx.adobe.com/security/products/flash-player/apsb16-39.html

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2016-12-13 16:08:54 UTC

Bulletin is now available.

Looks like Adobe wants that v11.2.202.644 users (which are affected) should upgrade to v24.0.0.186 as well.

Comment 2 Matt 2017-01-08 17:29:25 UTC

There even seems to be 24.0.0.189 out according to:

http://fpdownload.macromedia.com/pub/labs/flashruntimes/shared/air24_flashplayer24_releasenotes.pdf

Runtime Versions
Flash Player: 24.0.0.189

http://labs.adobe.com/technologies/flashruntimes/flashplayer/

http://labs.adobe.com/downloads/flashplayer.html

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2017-01-08 17:46:49 UTC

(In reply to Matt from comment #2)
> There even seems to be 24.0.0.189 out according to:

This is Adobe's beta release for the next upcoming version. It was only re-based against 24.0.0.186.



Fixed version in tree since 2016-12-13 via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=af80dd617dbd4bbc682fcf43ac7df38f0eeaeae1 and stable since 2016-12-15 via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=04faccfbbc130e63720bb31dbd8524f0f63324b9

New GLSA request filed.

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2017-01-10 13:56:06 UTC

This issue was resolved and addressed in
 GLSA 201701-17 at https://security.gentoo.org/glsa/201701-17
by GLSA coordinator Thomas Deutschmann (whissi).