<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for flash-player</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2015:1258-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2015-07-16T15:52:33Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2015-07-16T15:52:33Z</InitialReleaseDate>
    <CurrentReleaseDate>2015-07-16T15:52:33Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for flash-player</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">flash-player was updated to fix two security issues.

These security issues were fixed:
- CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752).
- CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752).
  </Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">sledsp3-flash-player-12002,sledsp4-flash-player-12002</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151258-1/</URL>
      <Description>Link for SUSE-SU-2015:1258-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2015-July/001498.html</URL>
      <Description>E-Mail link for SUSE-SU-2015:1258-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/937752</URL>
      <Description>SUSE Bug 937752</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2015-5122/</URL>
      <Description>SUSE CVE CVE-2015-5122 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2015-5123/</URL>
      <Description>SUSE CVE CVE-2015-5123 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 11 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Desktop 11 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP3" CPE="cpe:/o:suse:suse_sled:11:sp3">SUSE Linux Enterprise Desktop 11 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Desktop 11 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Desktop 11 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP4" CPE="cpe:/o:suse:suse_sled:11:sp4">SUSE Linux Enterprise Desktop 11 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="flash-player-11.2.202.491-0.11.1">
      <FullProductName ProductID="flash-player-11.2.202.491-0.11.1">flash-player-11.2.202.491-0.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="flash-player-gnome-11.2.202.491-0.11.1">
      <FullProductName ProductID="flash-player-gnome-11.2.202.491-0.11.1">flash-player-gnome-11.2.202.491-0.11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="flash-player-kde4-11.2.202.491-0.11.1">
      <FullProductName ProductID="flash-player-kde4-11.2.202.491-0.11.1">flash-player-kde4-11.2.202.491-0.11.1</FullProductName>
    </Branch>
    <Relationship ProductReference="flash-player-11.2.202.491-0.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 11 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP3:flash-player-11.2.202.491-0.11.1">flash-player-11.2.202.491-0.11.1 as a component of SUSE Linux Enterprise Desktop 11 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="flash-player-gnome-11.2.202.491-0.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 11 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP3:flash-player-gnome-11.2.202.491-0.11.1">flash-player-gnome-11.2.202.491-0.11.1 as a component of SUSE Linux Enterprise Desktop 11 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="flash-player-kde4-11.2.202.491-0.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 11 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP3:flash-player-kde4-11.2.202.491-0.11.1">flash-player-kde4-11.2.202.491-0.11.1 as a component of SUSE Linux Enterprise Desktop 11 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="flash-player-11.2.202.491-0.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP4:flash-player-11.2.202.491-0.11.1">flash-player-11.2.202.491-0.11.1 as a component of SUSE Linux Enterprise Desktop 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="flash-player-gnome-11.2.202.491-0.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP4:flash-player-gnome-11.2.202.491-0.11.1">flash-player-gnome-11.2.202.491-0.11.1 as a component of SUSE Linux Enterprise Desktop 11 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="flash-player-kde4-11.2.202.491-0.11.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Desktop 11 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Desktop 11 SP4:flash-player-kde4-11.2.202.491-0.11.1">flash-player-kde4-11.2.202.491-0.11.1 as a component of SUSE Linux Enterprise Desktop 11 SP4</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.</Note>
    </Notes>
    <CVE>CVE-2015-5122</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 11 SP3:flash-player-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP3:flash-player-gnome-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP3:flash-player-kde4-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP4:flash-player-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP4:flash-player-gnome-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP4:flash-player-kde4-11.2.202.491-0.11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>10</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151258-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-5122.html</URL>
        <Description>CVE-2015-5122</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/937752</URL>
        <Description>SUSE Bug 937752</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.</Note>
    </Notes>
    <CVE>CVE-2015-5123</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Desktop 11 SP3:flash-player-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP3:flash-player-gnome-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP3:flash-player-kde4-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP4:flash-player-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP4:flash-player-gnome-11.2.202.491-0.11.1</ProductID>
        <ProductID>SUSE Linux Enterprise Desktop 11 SP4:flash-player-kde4-11.2.202.491-0.11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>10</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2015/suse-su-20151258-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-5123.html</URL>
        <Description>CVE-2015-5123</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/937752</URL>
        <Description>SUSE Bug 937752</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
