The following security updates has been released for Ubuntu Linux:

USN-3845-2: FreeRDP vulnerabilities
USN-3995-1: Keepalived vulnerability
USN-3995-2: Keepalived vulnerability
USN-3997-1: Thunderbird vulnerabilities

USN-3845-2: FreeRDP vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3845-2
May 28, 2019

freerdp vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in FreeRDP.

Software Description:
- freerdp: RDP client for Windows Terminal Services

Details:

USN-3845-1 fixed several vulnerabilities in FreeRDP. This update
provides the
corresponding update for Ubuntu 18.04 LTS and Ubuntu 18.10.

Original advisory details:

Eyal Itkin discovered FreeRDP incorrectly handled certain stream
encodings. A
malicious server could use this issue to cause FreeRDP to crash,
resulting in a
denial of service, or possibly execute arbitrary code. This issue only
applies
to Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-8784, CVE-2018-8785)

Eyal Itkin discovered FreeRDP incorrectly handled bitmaps. A
malicious server
could use this issue to cause FreeRDP to crash, resulting in a denial
of
service, or possibly execute arbitrary code. (CVE-2018-8786, CVE-2018-
8787)

Eyal Itkin discovered FreeRDP incorrectly handled certain stream
encodings. A
malicious server could use this issue to cause FreeRDP to crash,
resulting in a
denial of service, or possibly execute arbitrary code. This issue only
applies
to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-
8788)

Eyal Itkin discovered FreeRDP incorrectly handled NTLM
authentication. A
malicious server could use this issue to cause FreeRDP to crash,
resulting in a
denial of service, or possibly execute arbitrary code. This issue only
applies
to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-
8789)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
libfreerdp-client1.1 1.1.0~git20140921.1.440916e+dfsg1-
15ubuntu1.18.10.1

Ubuntu 18.04 LTS:
libfreerdp-client1.1 1.1.0~git20140921.1.440916e+dfsg1-
15ubuntu1.18.04.1

In general, a standard system update will make all the necessary
changes.

References:
https://usn.ubuntu.com/usn/usn-3845-2
https://usn.ubuntu.com/usn/usn-3845-1
CVE-2018-8786, CVE-2018-8787, CVE-2018-8788, CVE-2018-8789

Package Information:

https://launchpad.net/ubuntu/+source/freerdp/1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.10.1

https://launchpad.net/ubuntu/+source/freerdp/1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1

USN-3995-1: Keepalived vulnerability

==========================================================================
Ubuntu Security Notice USN-3995-1
May 28, 2019

keepalived vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Keepalived could be made to crash or run programs if it received
specially crafted network traffic.

Software Description:
- keepalived: Failover and monitoring daemon for LVS clusters

Details:

It was discovered that Keepalived incorrectly handled certain HTTP status
response codes. A remote attacker could use this issue to cause Keepalived
to crash, resulting in a denial of service, or possibly execute arbitrary
code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
keepalived 1:1.3.9-1ubuntu1.1

Ubuntu 18.04 LTS:
keepalived 1:1.3.9-1ubuntu0.18.04.2

Ubuntu 16.04 LTS:
keepalived 1:1.2.24-1ubuntu0.16.04.2

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3995-1
CVE-2018-19115

Package Information:
https://launchpad.net/ubuntu/+source/keepalived/1:1.3.9-1ubuntu1.1
https://launchpad.net/ubuntu/+source/keepalived/1:1.3.9-1ubuntu0.18.04.2
https://launchpad.net/ubuntu/+source/keepalived/1:1.2.24-1ubuntu0.16.04.2

USN-3995-2: Keepalived vulnerability

==========================================================================
Ubuntu Security Notice USN-3995-2
May 28, 2019

keepalived vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM

Summary:

Keepalived could be made to crash or run programs if it received
specially crafted network traffic.

Software Description:
- keepalived: Failover and monitoring daemon for LVS clusters

Details:

USN-3995-1 fixed a vulnerability in keepalived. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

 It was discovered that Keepalived incorrectly handled certain HTTP
 status response codes. A remote attacker could use this issue to cause
 Keepalived to crash, resulting in a denial of service, or possibly
 execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
  keepalived 1:1.2.7-1ubuntu1+esm1

Ubuntu 12.04 ESM:
  keepalived 1:1.2.2-3ubuntu1.2

In general, a standard system update will make all the necessary
changes.

References:
  https://usn.ubuntu.com/usn/usn-3995-2
  https://usn.ubuntu.com/usn/usn-3995-1
  CVE-2018-19115

USN-3997-1: Thunderbird vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3997-1
May 28, 2019

thunderbird vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Thunderbird.

Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
bypass same-origin protections, or execute arbitrary code.
(CVE-2019-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,
CVE-2019-9797, CVE-2019-9800, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820)

Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted message, an attacker could
potentially exploit these to cause a denial of service, or execute
arbitrary code. (CVE-2019-5798, CVE-2019-7317)

A type confusion bug was discovered with object groups and UnboxedObjects.
If a user were tricked in to opening a specially crafted website in a
browsing context after enabling the UnboxedObjects feature, an attacker
could potentially exploit this to bypass security checks. (CVE-2019-9816)

It was discovered that history data could be exposed via drag and drop
of hyperlinks to and from bookmarks. If a user were tricked in to dragging
a specially crafted hyperlink to a bookmark toolbar or sidebar, and
subsequently back in to the web content area, an attacker could
potentially exploit this to obtain sensitive information. (CVE-2019-11698)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  thunderbird  1:60.7.0+build1-0ubuntu0.19.04.1

Ubuntu 18.10:
  thunderbird  1:60.7.0+build1-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
  thunderbird  1:60.7.0+build1-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  thunderbird  1:60.7.0+build1-0ubuntu0.16.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References:
  https://usn.ubuntu.com/usn/usn-3997-1
  CVE-2018-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,
  CVE-2019-11698, CVE-2019-5798, CVE-2019-7317, CVE-2019-9797,
  CVE-2019-9800, CVE-2019-9816, CVE-2019-9817, CVE-2019-9819,
  CVE-2019-9820

Package Information:
 
https://launchpad.net/ubuntu/+source/thunderbird/1:60.7.0+build1-0ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:60.7.0+build1-0ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:60.7.0+build1-0ubuntu0.18.04.1 
https://launchpad.net/ubuntu/+source/thunderbird/1:60.7.0+build1-0ubuntu0.16.04.1