Shockwave Flash 11,2,202,440 disabled as vulnerable

[Moonchild]

Why not simply disregard the separator, be it dot or comma?

You can't just disregard it. the problem seems to be that the comma isn't seen AS a separator.
It may yet be locale specific. internationalization getting in the way of what is supposed to be a standard format with periods because it's treated "as a number" (even though no number with multiple decimal separators exists).

I may have to do a mozregression and see if I can (1) reproduce it in ff and (2) find out if and if so, when, this was addressed. I can't imagine that this was in FF-release for over a year without a fix though, but maybe it was.

[vlatkoB]

FF shows the version correctly, with dots.
Also, as I already mentioned, all worked correctly till a day ago, when I updated the flash plugin.

[squarefractal]

It may yet be locale specific. internationalization getting in the way of what is supposed to be a standard format with periods because it's treated "as a number" (even though no number with multiple decimal separators exists).

I don't think so, because both strings happen to be present:

Code: Select all

$ strings libflashplayer.so | grep -P '11[^\w]2'
libgtk-x11-2.0.so.0
libgdk-x11-2.0.so.0
LNX 11,2,202,440
Shockwave Flash 11.2 r202
11.2.202.440
drm/%s/%s/%s/11.2.202.440%s

[SvenG]

I may have to do a mozregression and see if I can (1) reproduce it in ff and (2) find out if and if so, when, this was addressed. I can't imagine that this was in FF-release for over a year without a fix though, but maybe it was.

Looking at this bugzilla post
https://bugzilla.mozilla.org/show_bug.c ... 109795#c45
it has been a problem in Firefox too.

[Lucio Chiappetti]

I don't think so, because both strings happen to be present

I confirm the same output in the 440 libflashplayer.so I installed yesterday but also that commas and dots were present in the same place in the previous version (which I backed up offline)

Code: Select all

11,2,202,346
11.2.202.346
drm/%s/%s/%s/11.2.202.346%s

[nostril]

Hi

Debian Wheezy
LANG=en_US.UTF-8
LANGUAGE=en_US:en
LC_TIME="en_US.UTF-8"
like every other 'LC'

Palemoon 25.2.1 - with commas
Version: 11,2,202,440
VULNERABLE MESSAGE

Iceweasel ESR 31.4.0
Version: 11.2.202.440
EVERYTHING OK

GNU Icecat 31.4.0
Version: 11.2.202.440
EVERYTHING OK

Tried/copied blocklist file from Iceweasel and Icecat which results in the same VULNERABLE MESSAGE.
COPIED OLD BLOCKLISTt file from Palemoon 2015/01/15 over the current one and ERROR DISAPEARS.

Removed write permission of blocklist file for the time being, and Bob's my Uncle.

[Moonchild]

I've updated the blocklist to allow any v11 without warning for the moment. It may take a day to propagate unless you remove the blocklist.xml manually from your profile.

[nostril]

Pulled the updated blocklist and it does not make a difference on Debian Wheezy.
On Pale Moon it still brings up the 'should be updated' message.

I copied the updated blocklist across to Iceweasel and Icecat which DOES NOT bring the error in both browsers.
I tried that with the old blocklist too and it DID NOT bring up an error either.

Palemoon blocklist from 01/15/2015 works and DOES NOT bring the error.

most bizarre

[Moonchild]

Please verify that the blocklist you pulled has a lastupdate stamp of 1422619961000. It should work and no longer block libflashplayer.so 11.anything.
If it doesn't have that timestamp then you've pulled the previous version.

It has to be an error in the Pale Moon code somewhere that causes this, but I have to hunt down exactly where and what. it was obviously broken in the base code I used when forking off.

[Moonchild]

Hunt successful: something that was present since FF 1.0, and fixed in FF28 FF27 (it was uplifted).
bug #942356 I'll have this fixed in the next version.

Edit: this seems to be a fault of Adobe's plugin trying to be "helpful" by localizing the version string

[nostril]

Update stamp 1422619961000 does still bring up the error.

Glad you found the cause of matter. Cheers.

[SvenG]

Edit: this seems to be a fault of Adobe's plugin trying to be "helpful" by localizing the version string

How respectful, I already felt discriminated by the periods, as a German I have the right to see commas. What's next, a female version in pink?

[Moonchild]

I don't think so, because both strings happen to be present

I confirm the same output in the 440 libflashplayer.so I installed yesterday but also that commas and dots were present in the same place in the previous version (which I backed up offline)

Code: Select all

11,2,202,346
11.2.202.346
drm/%s/%s/%s/11.2.202.346%s

This was a misunderstanding -- it does see the version with commas (since that is the first in the file). But this is a localization "as if it was a number" but natural numbers never have multiple decimal points, so this is a mistake in localizing something that should not be localized.
Later FF and Chrome have a bit of code where this is special-cased for Flash and simply fixed up (since it's apparently not changed since then in the plugin and still being done). I'll do the same in Pale Moon.

The reason it popped up recently is NOT because you updated the flash player, but because I recently updated the blocklist. there was no 11.* block entry in the list before, so any 11.* version would be in the clear.

[Moonchild]

Edit: this seems to be a fault of Adobe's plugin trying to be "helpful" by localizing the version string

How respectful, I already felt discriminated by the periods, as a German I have the right to see commas. What's next, a female version in pink?

New from Adobe: ♥ Flash Plugin FE 18.0 ♥

[Moonchild]

Update stamp 1422619961000 does still bring up the error.

Glad you found the cause of matter. Cheers.

Pff. OK. Reverting the blocklist plugin section until the next version then.

Update pushed, you should be able to pull a fresh copy and check.

[SvenG]

Checked: works!

[benfaust]

How does one pull the latest build? I checked for updates in the About, but it said I'm up to date. Still can't run or update Shockwave.

[trava90]

If you're referring to the blocklist, it will be updated automatically. If you do want to update manually now, simply delete the blocklist.xml file from your profile and the browser will gab the latest version.

If you're referring to seeing commas in the version number, this was fixed in Pale Moon v25.4, so you need to update Pale Moon from linux.palemoon.org

[coupdeforce]

Thanks, deleted the blocklist and the flash plugin works again.