7

When I go to websites using Flash in Firefox, I get this warning:

This plugin is vulnerable and it should be updated.

Mozilla's plugin check agrees:

Adobe Flash Player Shockwave Flash 11.2 r202 vulnerable 11.2.202.438

But if I follow the update link and download the Ubuntu version (opening with Software Center) I get

There isn’t a software package called “adobe-flashplugin” in your current software sources.

If I run

sudo apt-get update
sudo apt-get install -y flashplugin-installer

I'm told

flashplugin-installer is already the newest version.

So how can I update?

4
  • 2
    You definitely need to restart the browser. I believe you might have to log out and back in as well. (I had this happen to me on a Fedora install just last night; it didn't see the updated flash until I logged back in. But I'm not sure how the flash update is recognized and whether Ubuntu handles it differently)
    – chaskes
    Commented Jan 30, 2015 at 0:32
  • @chaskes: I'm embarassed to say that this was my problem. Would you post this as an answer?
    – Charles
    Commented Jan 30, 2015 at 0:38
  • Don't be embarassed. ;) I won't say how long it took me to try that last night. Answer posted
    – chaskes
    Commented Jan 30, 2015 at 0:39
  • The Flashplugin has been updated yesterday. The most recent version is 11.2.202.442 for Linux. Update now.
    – MadMike
    Commented Feb 6, 2015 at 12:54

5 Answers 5

Reset to default
5

Another update: Currently flash may be blocked if it doesn't show as having the right version - e.g. for me on Firefox it shows as 11.2.202.569 in Firefox (And blocks it) but the package has 11.2.202.577 installed (the flash lib binary shows also 11_2_202_577, so something's broke). Basically it is up to date if it matches the version here.

UPDATE (from https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/FirefoxAndAdobeFlashNPAPI):

Firefox blocks Adobe Flash NPAPI plugin for 11.2.202.481 and earlier

Several serious security vulnerabilities were found in Adobe's flash plugin with exploits known to be in the wild. Because of the critical nature of the vulnerabilities, the Mozilla foundation decided to block this version of the plugin. Unfortunately, at the time of the blocklist, only the PPAPI version of the plugin (as used by chromium) was available and Firefox users found the NPAPI plugin was blocked via Firefox's click-through security mechanism.

UPDATE: As of 2015/07/16, Adobe released 11.2.202.491 which fixes all known issues for PPAPI and NPAPI and updates are available for Ubuntu

Timeline

  • 2015 Jul 14: Adobe releases flash plugin security update for PPAPI ahead of NPAPI
  • 2015 Jul 14: Ubuntu Security contacts Adobe regarding NPAPI. Ubuntu told NPAPI plugin will be ready soon
  • 2015 Jul 14: Ubuntu releases adobeflash-plugin and flashplugin-nonfree with updates for PPAPI only
  • 2015 Jul 16: Adobe releases updates for NPAPI (11.2.202.491)
  • 2015 Jul 16: Ubuntu releases adobeflash-plugin and flashplugin-nonfree with updates for NPAPI (11.2.202.491), including the previous PPAPI fixes

SecurityTeam/KnowledgeBase/FirefoxAndAdobeFlashNPAPI (last edited 2015-07-16 13:36:40 by jdstrand)

You should be able to update/install it using:

sudo apt-get update
sudo apt-get install flashplugin-installer

(or sudo apt-get install --reinstall flashplugin-installer, sudo apt-get remove --purge flashplugin-installer && sudo apt-get install flashplugin-installer etc)

or, it should also be updated if you use:

sudo apt-get update
sudo apt-get upgrade

Flash is currently being blocked in Firefox by default in all versions:

Anyway, to fix it:

  • Open the Add-ons Manager ('Tools' > 'Add-ons', about:addons, CtrlShift+A)

  • Go to Plugins

  • In the dropdown next to 'Shockwave Flash' select 'Ask to Active'

Please only do this if desperate - youtube and other sites now have a option to use HTML5, which should be used in preference to this)

This is due to the unfixed security issues in the Adobe Flash plugin, which can be widely exploited by attackers.

The flash plugin in general is very insecure and should be replaced - apparently Adobe and others should be reducing the use of Flash to replace it with HTML5, WebGL and other open standards. One of the reasons (other than they couldn't be asked...) that the Linux version of Flash is stuck at 11.2 (the version for linux gets security backports for 5 years from release) is due to the supposed roadmap with which Adobe will remove Flash support globally (supposedly).

See also:

8
  • @mchid - i think it is happening on other OSs as well (everyone will just switch to chrome so Google can track everyone's movements...). Also its better flash being blocked and not being hacked i suppose...
    – Wilf
    Commented Jul 15, 2015 at 13:26
  • The problem I have is that I can't watch TV now on Firefox as the website thinks I need to update flash and they don't offer support for chrome which gets a generic error and can't play the stream. They used to use silver light which works fine but switched to flash the same day Firefox started the block, maybe just a coincidence.
    – mchid
    Commented Jul 15, 2015 at 13:46
  • @mchid - its not the website that think you need to update flash, its the browser. You either need to the above fix (Firefox currently blocks 'Always Activate' , or do DrTechno's fix (I think Mozilla has classified all current flash versions as unsafe, Adobe will have to do a update fixing the specified problems to sort it out)
    – Wilf
    Commented Jul 15, 2015 at 15:16
  • Thanks, I finally got an update for flash on firefox that is not considered unsafe and firefox excepts it but the website still does not. I believe they check for the newest version 18 so it seems to be unrelated to the firefox issue, just the website. I called the company and they just said they don't support linux (I don't want support, just don't want to be blocked).
    – mchid
    Commented Jul 16, 2015 at 23:16
  • 1
    @SteveKroon - try using sudo apt-get install --reinstall flashplugin-installer. Firefox will only unblock if it is a version newer than the 481 release.
    – Wilf
    Commented Jul 21, 2015 at 14:46
1

Just do this

sudo apt-get install flashplugin-installer

4
  • 2
    flashplugin-installer is already the newest version.
    – Charles
    Commented Jan 30, 2015 at 0:15
  • 1
    then try sudo apt-get remove --purge flashplugin-installer then run sudo apt-get install flashplugin-installer again
    – Trevor Clarke
    Commented Jan 30, 2015 at 0:16
  • @TrevorClarke doesn't work. I'm also being blocked by websites that require the "newest" version. Clicking on the link goes to adobe and adobe goes to software center. Newest version already installed reinstalled and re-reinstalled with flashplugin-installer >(
    – mchid
    Commented Jul 15, 2015 at 1:30
  • sudo apt-get install --reinstall flashplugin-installer ?
    – Wilf
    Commented Jul 21, 2015 at 14:46
1

I noticed that all versions of adobe flash (current version on all operating systems) is blocked now from automatically running. what I did is with firefox closed, open up the home foldier, show hidden files then go to .mozilla/firefox/*.default and edit the pluginreg.dat file search for your version (mine was 11.2.202.481 located under the entry /usr/lib/flashplugin-installer/libflashplayer.so:$ in the file) I changed the 11 to 19 and no more annoying message from firefox. now firefox thinks my version is 19.2.202.481

1
  • Why do that? Why manipulate Firefox and probably trick someone else who just needs to use your computer to look something up, where you don't provide them guest access? As Wilf mentioned, you can set it to Ask to Activate and it'll work when you need it. Also these plugin updates happen every now and then, which would require to always remember how to fake the version number and remember that you faked it if you use more than one computer with Firefox. Managing plugins through Firefox is the better and more consistent solution here.
    – LiveWireBT
    Commented Jul 17, 2015 at 5:57
0

The problem is explained here: https://blocklist.addons.mozilla.org/en-US/firefox/blocked/p796 The plugin for Linux is not safe :(

2
  • Usually only old versions are blocked - the flash plugin for every OS is unsafe (the linux one gets the secuirty fixes of the newer versions despite being 11.2)
    – Wilf
    Commented Jul 14, 2015 at 14:23
  • This is a bunch of milarkey, that notice is for version 11.2.202.424 or older and I'm running 11.2.202.481. Last I checked, 481 was higher than 424. In fact, I used a calculator to verify that 481 is greater than 424 by 51 (math for the 8 year old elementary students running firefox)!
    – mchid
    Commented Jul 14, 2015 at 22:58
0

Shockwave Flash 11.2.202.491 installed in the regular Ubuntu software update on 10/28/2016 is still blocked as far as I can tell.

1
  • 1
    The latest version in the Ubuntu archive is 11.2.202.643, so you can't reasonably have got 11.2.202.491 via a regular software update recently.
    – Gunnar Hjalmarsson
    Commented Oct 30, 2016 at 0:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .