ALT-BU-2014-2712-1
Branch sisyphus update bulletin.
Closed bugs
incompatible with mercurial 2.9
Package adobe-flash-player updated to version 11-alt28 for branch sisyphus in task 118323.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2014-0506
Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- SUSE-SU-2014:0535
- SUSE-SU-2014:0535
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0549
- openSUSE-SU-2014:0549
- RHSA-2014:0380
- RHSA-2014:0380
- GLSA-201405-04
- GLSA-201405-04
- http://twitter.com/thezdi/statuses/443886338077495296
- http://twitter.com/thezdi/statuses/443886338077495296
- http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/
- http://www.pwn2own.com/2014/03/pwn2own-results-for-wednesday-day-one/
Modified: 2024-11-21
CVE-2014-0507
Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows attackers to execute arbitrary code via unspecified vectors.
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- SUSE-SU-2014:0535
- SUSE-SU-2014:0535
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0549
- openSUSE-SU-2014:0549
- RHSA-2014:0380
- RHSA-2014:0380
- GLSA-201405-04
- GLSA-201405-04
- 66701
- 66701
- 1030035
- 1030035
Modified: 2024-11-21
CVE-2014-0508
Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- SUSE-SU-2014:0535
- SUSE-SU-2014:0535
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0549
- openSUSE-SU-2014:0549
- RHSA-2014:0380
- RHSA-2014:0380
- GLSA-201405-04
- GLSA-201405-04
- 1030035
- 1030035
Modified: 2024-11-21
CVE-2014-0509
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- http://helpx.adobe.com/security/products/flash-player/apsb14-09.html
- SUSE-SU-2014:0535
- SUSE-SU-2014:0535
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0520
- openSUSE-SU-2014:0549
- openSUSE-SU-2014:0549
- RHSA-2014:0380
- RHSA-2014:0380
- GLSA-201405-04
- GLSA-201405-04
- 66703
- 66703
- 1030035
- 1030035
Package strongswan updated to version 5.1.3-alt1 for branch sisyphus in task 118357.
Closed vulnerabilities
BDU:2015-04320
Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-04321
Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-09781
Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2024-11-21
CVE-2014-2338
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.
- SUSE-SU-2014:0529
- SUSE-SU-2014:0529
- openSUSE-SU-2014:0697
- openSUSE-SU-2014:0697
- openSUSE-SU-2014:0700
- openSUSE-SU-2014:0700
- 57823
- 57823
- DSA-2903
- DSA-2903
- 66815
- 66815
- http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html
- http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html