662217 - Update the Windows RDF for the Flash Player 10.3.181.22 Security Update

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[John Pfeiffer]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.9
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.9

Please update the Windows PFS RDF configuration for the Flash Player 10.3.181.22 Security update which when live this afternoon. Here are the RDF changes (note that the version has not changed):

<pfs:version>10.3.181</pfs:version>
<pfs:InstallerHash>sha256:fc663c9610595af022cf51b1c2e8565cc46d858a6f336965dd9e26f33c0d65ea</pfs:InstallerHash>


Reproducible: Always

Comment 1

[Carsten Book [:Tomcat]]

adobe annoucement is here btw http://www.adobe.com/support/security/bulletins/apsb11-13.html

Comment 2

[Kev Needham [:kev]]

Attachment: Updated pfs.php for new Flash Player installer

Updated patch for Adobe Flash security update that was released last night.

Morgamic, could you review and Wil could you push when the review is complete?

Many thanks!

Comment 3

[Michael Morgan [:morgamic]]

Comment on attachment 537537 [details] [diff] [review]
Updated pfs.php for new Flash Player installer

No version change?

Comment 4

[Wil Clouser [:clouserw]]

r89988.  Will go out tomorrow

Comment 5

[Kev Needham [:kev]]

(In reply to comment #3)
> Comment on attachment 537537 [details] [diff] [review] [review]
> Updated pfs.php for new Flash Player installer
> 
> No version change?

Nope.

Comment 6

[Justin Dolske [:Dolske]]

What's the significance of the version not changing? The Adobe download site (and about:plugins) report a full version of "10.3.181.22" (was .16). Should the full version be used here (and what makes use of this version number)?

Comment 7

[Wil Clouser [:clouserw]]

(In reply to comment #4)
> r89988.  Will go out tomorrow

This is live now

Comment 8

[Kev Needham [:kev]]

The significance for this bug is minimal. PFS is only consulted on an initial install, and is not used for updates. We could update it, but the important bits are the hash matching the .exe that is being downloaded (if they don't match, the user is pushed to the adobe site for a manual install).

 Version numbers have greater significance on plugin checks, as some browsers/platforms only report the first three digits.

(In reply to comment #6)
> What's the significance of the version not changing? The Adobe download site
> (and about:plugins) report a full version of "10.3.181.22" (was .16). Should
> the full version be used here (and what makes use of this version number)?

Comment 9

[Kev Needham [:kev]]

(In reply to comment #7)
> (In reply to comment #4)
> > r89988.  Will go out tomorrow
> 
> This is live now

Thanks Wil! much appreciated!

Dolske: One last thing, we could add the last version number to future updates, but it's descriptive metadata only for PFS.

Comment 10

[John Pfeiffer]

Thanks for the quick turnaround folks!

Comment 11

[Justin Dolske [:Dolske]]

(In reply to comment #9)

> Dolske: One last thing, we could add the last version number to future
> updates, but it's descriptive metadata only for PFS.

Might be a good idea for clearity / record keeping. Though it sounds like it isn't actually used for anything.