Need to be updated for new stable version (9,0,48,0)

Bug #125131 reported by Wade Simmons
284
Affects Status Importance Assigned to Milestone
Dapper Backports
New
Undecided
Unassigned
flashplugin-nonfree (Ubuntu)
Fix Released
Undecided
Unassigned
Feisty
Invalid
Critical
John Vivirito

Bug Description

Binary package hint: flashplugin-nonfree

The install downloads from http://fpdownload.macromedia.com/get/flashplayer/current/install_flash_player_9_linux.tar.gz which has been updated to 9,0,48,0 today. The install currently fails with:

Download done.
md5sum mismatch install_flash_player_9_linux.tar.gz
The Flash plugin is NOT installed.

CVE References

Revision history for this message
Dawid Wróbel (dawidw) wrote :

Please also note, that despite this md5sum mismatch the package itself is installed. However it's empty, as it doesn't contain the plugin files it's supposed to (libflashplayer.so etc.).

Revision history for this message
John Vivirito (gnomefreak) wrote :

To the person that plans on fixing this:
Please make sure the regressions are gone before upgrading to that version if at all possible, I understand there were some show stopper regressions in this version but not sure if they have been fixed or not.

Revision history for this message
William Grant (wgrant) wrote :

Once it's fixed in gutsy, it'll also need fixing in feisty, along with edgy- and dapper-backports.

Revision history for this message
Alexander Sack (asac) wrote :

just send up to feisty-proposed; please test so we get positive feedback in line with sru procedure outlined on wiki: https://wiki.ubuntu.com/StableReleaseUpdates

Changed in flashplugin-nonfree:
assignee: nobody → asac
status: New → In Progress
importance: Undecided → Critical
status: In Progress → Fix Committed
Revision history for this message
Alexander Sack (asac) wrote :
Changed in flashplugin-nonfree:
status: Fix Committed → In Progress
Revision history for this message
Martin Pitt (pitti) wrote :

  flashplugin-nonfree (9.0.48.0.0ubuntu1) gutsy; urgency=low

  * new upstream version 9.0.48.0
  * debian/postinst: update md5sums according to files of new upstream version
    upstream update released on 10 Jul 2007.

 -- Alexander Sack <email address hidden> Fri, 13 Jul 2007 12:59:29 +0200

Changed in flashplugin-nonfree:
status: New → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

Accepted into feisty-proposed, please go ahead with QA testing.

Changed in flashplugin-nonfree:
status: In Progress → Fix Committed
Revision history for this message
Alexander Sack (asac) wrote :

flashplugin-nonfree (9.0.48.0.0ubuntu1~7.04.0) feisty-proposed; urgency=low

  * SRU to fix "fail to install flashplugin-nonfree" grave bug
    in feisty (LP: #125131).
  * new upstream version 9.0.48.0
  * debian/postinst: update md5sums according to files of new upstream version
    upstream update released on 10 Jul 2007.

 -- Alexander Sack <email address hidden> Fri, 13 Jul 2007 13:22:10 +0200

Changed in flashplugin-nonfree:
status: Fix Committed → Fix Released
Martin Pitt (pitti)
Changed in flashplugin-nonfree:
status: Fix Released → Fix Committed
Revision history for this message
Wade Simmons (wadesimmons) wrote :

manually built and installed 9.0.48.0.0ubuntu1~7.04.0 on my Feisty machine and it appears to be running perfectly. This was the first install of flashplugin-nonfree on my machine (not an upgrade).

Revision history for this message
John Vivirito (gnomefreak) wrote :

9.0.48.0.0ubuntu2~7.04.0 has been built and waiting for revu, this fixes the debian/config md5sums

Changed in flashplugin-nonfree:
assignee: asac → gnomefreak
Revision history for this message
John Vivirito (gnomefreak) wrote :

see bug #125986 for the updated version 9.0.48.0.0ubuntu2~7.04.0

Changed in flashplugin-nonfree:
status: Fix Committed → Fix Released
Revision history for this message
David H (david-houlder) wrote :

Note that 9.0.31 (the current one in dapper-backports) is vulnerable.
http://www.adobe.com/support/security/bulletins/apsb07-12.html

Revision history for this message
20after4 (twentyafterfour) wrote :

The proposed update works well for me so far.

Revision history for this message
Conrad Knauer (atheoi) wrote :

I downloaded http://archive.ubuntu.com/ubuntu/pool/multiverse/f/flashplugin-nonfree/flashplugin-nonfree_9.0.48.0.0ubuntu2_i386.deb and installed it with Gdebi; works great :)

http://www.adobe.com/products/flash/about/ indicates that I am now running flash version "9,0,48,0"

Revision history for this message
Conrad Knauer (atheoi) wrote :

Whoops; that was the Gutsy package (I'm running Feisty, though like I said, it works :)

I uninstalled it and installed the Feisty package:
http://archive.ubuntu.com/ubuntu/pool/multiverse/f/flashplugin-nonfree/flashplugin-nonfree_9.0.48.0.0ubuntu1~7.04.0_i386.deb

That works too ^_^

Revision history for this message
era (era) wrote :

Wasn't Adobe's new upload a security fix? Thus, shouldn't this be handled as a security update, instead of just "feisty-proposed"? Cf. e.g. http://www.linuxsecurity.com/content/view/128769/

Revision history for this message
era (era) wrote :

Ack, sorry, didn't see the CVE reference and all that (why would something like that be hidden by default in Launchpad anyway!?)

Revision history for this message
David Beer (david-thebeerfamily) wrote :

Guys, I have just tried installing flash and still get the original error, When checked I am still downloading version 9.0.31, when is this likely to reach the main repos. I am happy to use the link above to install the fix, I am sure others would prefer to download from the main repos.

Revision history for this message
Denilson Sá (denilsonsa) wrote :

Not sure if this helps, but the related bug report for Gentoo guys is here:
http://bugs.gentoo.org/show_bug.cgi?id=185141
The main reason is upstream changing the tarball without changing its name. Maybe people from Ubuntu and Gentoo could look at this issue together, because that's a common problem for both distros (and probably also Debian and others).

Revision history for this message
Tormod Volden (tormodvolden) wrote :

Upgrade failed here: I upgraded to flashplugin-nonfree 9.0.48.0.0ubuntu1~7.04.0 but it didn't download and install the new upstream blob because the last one from January was left in /var/cache/flashplugin-nonfree. Deleting the old blob and force reinstall worked.

$ ls -l /var/cache/flashplugin-nonfree/
-rw-r--r-- 1 root root 2609703 2007-01-09 20:11 install_flash_player_9_linux.tar.gz

$ sudo apt-get install --reinstall flashplugin-nonfree
<<< snip >>>
Setting up flashplugin-nonfree (9.0.48.0.0ubuntu1~7.04.0) ...
Installing from local file /var/cache/flashplugin-nonfree/install_flash_player_9_linux.tar.gz
md5sum mismatch install_flash_player_9_linux.tar.gz
The Flash plugin is NOT installed.

$ sudo rm /var/cache/flashplugin-nonfree/install_flash_player_9_linux.tar.gz
$ sudo apt-get install --reinstall flashplugin-nonfreeReading package lists... Done
<<< snip >>>
Setting up flashplugin-nonfree (9.0.48.0.0ubuntu1~7.04.0) ...
Downloading...
--19:29:16-- http://fpdownload.macromedia.com/get/flashplayer/current/install_flash_player_9_linux.tar.gz
           => `./install_flash_player_9_linux.tar.gz'
Resolving fpdownload.macromedia.com... 84.53.162.70
Connecting to fpdownload.macromedia.com|84.53.162.70|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2,608,602 (2.5M) [application/x-gzip]
<<< snip >>>
 2500K .......... .......... .......... .......... ....... 100% 444.45 KB/s

19:29:22 (439.05 KB/s) - `./install_flash_player_9_linux.tar.gz' saved [2608602/2608602]

Download done.
Flash Plugin installed.

$ ls -l /var/cache/flashplugin-nonfree/total 2552
-rw-r--r-- 1 root root 2608602 2007-07-05 20:48 install_flash_player_9_linux.tar.gz

Changed in flashplugin-nonfree:
status: Fix Released → Confirmed
Revision history for this message
Denilson Sá (denilsonsa) wrote :

This bug also happens on newly installed machines.

I see Gentoo guys are now downloading a RPM file and unpacking it to get the required files. See the link to bug report I posted previously. (and no, Gentoo is not RPM-based)

Revision history for this message
Martin Pitt (pitti) wrote :

The current Feisty SRU is already handled in bug 125233, so I close the Feisty task of this one.

Changed in flashplugin-nonfree:
status: Confirmed → Invalid
Revision history for this message
atleta (launchpad-atleta) wrote :

Why is it necessary to update and test the package every time there is a new flash player release? You basically just change the the MD5 in the install script. This should be automated because this way flash plugin is not installable for a few days after a new release (that seems to happen multiple times a day).

The actual MD5 sum could reside on a server that could update itself a few times a day by watching and automatially downloading the flash install and then generating the MD5's. Of course it should check the contents and structure of the package to see if it can be installed (i.e. it contains the necessary files and only those).

This would yield a much better solution with decreased maintenance and higher availability. It could (well, should) keep a track of the MD5 sums for the older install packages just in case someone wants to install those.

(Sorry for using a nickname, I didn't realize that I should use a real name here and now I can't find where to change it -- Laszlo Marai)

Revision history for this message
John Vivirito (gnomefreak) wrote :

the md5sum is for a newer version of flash than you had installed we test this so its less likely that the end users see breakage.

Revision history for this message
Svante v. Erichsen (serichsen) wrote :

For the end user perspective: I checked the "add/remove applications" (in Xubuntu 7.04, after update), and there the current version of flashplugin-nonfree seems to be 9.0.31.0.2ubuntu1 . When trying to install, the md5 checksum fails, so no installation takes place.

How long will it be until 9.0.48 is available in the "add/remove applications" list?

Revision history for this message
John Vivirito (gnomefreak) wrote :

Harleqin,
Its already in feisty-proposed repos it may be a while until it hits the security repos, I have been out of town since the day after i asked for the upload, but it is in proposed.

Revision history for this message
Aniruddha Shankar (kream) wrote :

flash installed for me with flashplugin-nonfree_9.0.48.0.0ubuntu3_i386.deb

flashplugin-nonfree_9.0.48.0.0ubuntu1~7.04.1_i386.deb didn't work.

Revision history for this message
David Walker (dave-mudsite) wrote :

19:04:59 (69.76 KB/s) - `./install_flash_player_9_linux.tar.gz' saved [3036127/3036127]

Download done.
md5sum mismatch install_flash_player_9_linux.tar.gz
The Flash plugin is NOT installed.

----- /etc/apt/sources.list
root@dave-desktop:/home/dave# cat /etc/apt/sources.list
deb http://us.archive.ubuntu.com/ubuntu/ gutsy main restricted universe multiverse
deb-src http://us.archive.ubuntu.com/ubuntu/ gutsy main restricted universe multiverse

deb http://us.archive.ubuntu.com/ubuntu/ gutsy-proposed main restricted universe multiverse
-----

please note, I took out the security updates to test this.

--
dave

Revision history for this message
era (era) wrote :

David: there is a separate bug for Gutsy, and also this one is classified as a duplicate. See http://ubuntuforums.org/showthread.php?t=636397 and https://bugs.launchpad.net/bugs/173890

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.